Description

The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T05:16:46.620Z",
  "pubdate": "2026-08-16T05:16:46.620Z",
  "executiveSummary": "The Platnosci Online Blue Media (Autopay) plugin for WordPress in versions up to, and including, 5.0.0 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists due to inadequate input sanitization, missing capability checks, and the complete absence of nonce verification within the settings management component. Specifically, unauthenticated threat actors can leverage the 'bm_woocommerce_css_editor_content' POST parameter to inject arbitrary web scripts and malicious payloads directly into the database via the WordPress options table. The injected payload is subsequently rendered without any output escaping inside a style block on the WooCommerce checkout page. Consequently, any visitor or customer accessing the compromised checkout page will execute the arbitrary script within their browser context in the scope of the affected session. This exposes users to significant security risks, including session hijacking, credential theft, and unauthorized actions performed on their behalf. The vulnerability requires zero authentication or prior privileges, making it trivially exploitable over the network by any unauthenticated attacker capable of crafting and executing an HTTP POST request targeting the exposed initialization hook.",
  "technicalDetails": "The vulnerability resides in the Platnosci Online Blue Media (Autopay) plugin for WordPress, specifically affecting versions up to, and including, 5.0.0. The root cause of the flaw stems from a lack of secure coding practices in the request handling, data sanitization, and output rendering pipelines. The initialization routing maps the Css_Editor::handle_save() method directly to the WordPress 'init' hook via the Settings_Manager::init_once() function. During this hook execution, the application processes incoming HTTP requests without enforcing any capability checks or verifying cryptographic nonces to ensure request legitimacy.\nThe vulnerable component reads the raw, user-controlled $_POST parameter named 'bm_woocommerce_css_editor_content' and immediately writes this unvalidated input to the 'woocommerce_bluemedia_settings' option utilizing the WordPress update_option() function. Because no input sanitization or validation is applied, an unauthenticated attacker can submit arbitrary strings, including malicious HTML and JavaScript payloads, which are then durably stored inside the WordPress database.\nThe attack flow proceeds as follows: First, an unauthenticated attacker sends a crafted HTTP POST request containing the malicious JavaScript payload assigned to the 'bm_woocommerce_css_editor_content' parameter. Second, the server processes the request via the unauthenticated 'init' hook, invoking Css_Editor::handle_save() which persists the payload into the database option 'woocommerce_bluemedia_settings'. Third, when a legitimate user or customer navigates to the WooCommerce checkout page, the Css_Frontend::print_to_wp_head() method retrieves the stored settings and echoes the payload directly inside a <style> block without any output escaping.\nDue to the lack of context-aware output encoding, the browser interprets the injected content as executable script code rather than styling directives. Consequently, the payload executes in the victim's browser context whenever the WooCommerce checkout page is accessed. This network-exploitable vulnerability completely bypasses authentication and privilege requirements, granting unauthenticated attackers the ability to execute arbitrary scripts and achieve Stored Cross-Site Scripting capabilities within the affected WordPress environment."
}