Autopay
Monthly
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.