EUVD-2026-60769
GHSA-7cj7-6fgc-ppx4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS with no auth; scope change covers browser context hijacking; availability impact not credibly applicable to reflected XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
AnalysisAI
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Autopay WordPress plugin version 5.0.0 or earlier must be installed and active on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 7.1 is driven primarily by the scope change (S:C) and network accessibility (AV:N/AC:L/PR:N), though the mandatory user interaction (UI:R) meaningfully constrains automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running Autopay ≤ 5.0.0 and crafts a URL embedding a JavaScript payload in a vulnerable parameter handled by the plugin. The attacker distributes this URL to site administrators or authenticated customers via phishing email, targeting the payment workflow context to maximize the likelihood of interaction. … |
| Remediation | Update the Autopay WordPress plugin to a version later than 5.0.0 as soon as a patched release is published; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/platnosci-online-blue-media/vulnerability/wordpress-autopay-plugin-5-0-0-cross-site-scripting-xss-vulnerability for the exact fix version, which was not independently confirmed from the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit WordPress installations for Autopay plugin versions ≤5.0.0 and immediately disable or remove the plugin from production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanentl
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today