https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:38:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-15002 <p><strong>Affected:</strong> bluemediapl Autopay</p> <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> <p><strong>Affected:</strong> bluemediapl Autopay</p> <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> https://vulnerability.circl.lu/vuln/cve-2026-15002