CVE-2026-14293
Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.
| Vendor | unknown |
| Product | autopay |
| Published | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown autopay
Be the first to know when new unknown vulnerabilities affecting unknown autopay are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Autopay
0 < 5.0.1
References
Credits
Pedro Pinho WPScan