Cross-Site Scripting Vulnerability in Autopay WordPress Plugin
CVE-2026-14293
Key Information:
Badges
What is CVE-2026-14293?
The Autopay WordPress plugin prior to version 5.0.1 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from the failure to validate user capabilities and nonces during the processing of styling options submitted through public requests. As a result, unauthenticated attackers can store malicious JavaScript code that is subsequently executed in the browsers of any users visiting the checkout page, including administrators. This security lapse compromises user safety and allows attackers to manipulate website behaviors.
Affected Version(s)
Autopay 0 < 5.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.