Stored Cross-Site Scripting Vulnerability in Blue Media Autopay Plugin for WordPress

CVE-2026-15002

What is CVE-2026-15002?

The Blue Media Autopay plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute arbitrary scripts through the 'bm_woocommerce_css_editor_content' POST parameter. A lack of capability checks, nonce verification, and input sanitization in the Css_Editor::handle_save() method exposes the plugin's settings to potential exploitation. The malicious script could be injected into the WooCommerce checkout page, leading to unauthorized access and potentially harmful actions against users who visit the compromised page.

References