Executive Summary
A high-severity Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-15002) has been disclosed in the Platnosci Online Blue Media (Autopay) plugin for WordPress and WooCommerce. The flaw carries a CVSS score of 7.2 and allows authenticated attackers to inject persistent malicious scripts via the plugin's CSS editor functionality.
CVSS Score: 7.2 (High)
The vulnerability resides in the Css_Editor::handle_save() method, which processes the bm_woocommerce_css_editor_content POST parameter. This method is wired to the WordPress init hook and lacks proper output sanitization, allowing injected scripts to persist in the database and execute in the browsers of victims — including administrators — who visit affected pages. All versions up to and including 5.0.0 are affected.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-15002 |
| CVSS Score | 7.2 (High) |
| Type | Stored Cross-Site Scripting (XSS) |
| Attack Vector | Network |
| Privileges Required | Low (authenticated, shop manager or above) |
| User Interaction | Required (victim visits affected page) |
| Persistent | Yes — stored in database |
| Affected Plugin | Platnosci Online Blue Media (Autopay) |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Platnosci Online Blue Media (Autopay) | <= 5.0.0 | Pending / Uninstall |
Technical Details
The Css_Editor::handle_save() method in the Autopay plugin is registered on the WordPress init hook, making it execute early in the WordPress lifecycle. The method reads the bm_woocommerce_css_editor_content POST parameter directly and saves it to the WordPress options table without sanitizing or escaping its contents.
When this stored content is later rendered in WordPress admin pages or WooCommerce store pages, the unsanitized payload executes as JavaScript in the victim's browser.
Attack Scenario
1. Attacker gains low-privilege authenticated access (e.g., shop manager)
2. Attacker sends POST request to the Autopay CSS editor save endpoint
bm_woocommerce_css_editor_content=<script>malicious payload</script>
3. Payload is saved to the WordPress options table unescaped
4. Administrator or other user visits any page rendering the Autopay CSS
5. Attacker's script executes in the victim's browser
6. Session hijack, credential theft, or admin account creation followsStored XSS Impact Chain
| Step | Impact |
|---|---|
| Payload stored | Persists until manually removed; survives page reloads |
| Admin visits page | Script executes with full admin browser session |
| Session token captured | Attacker gains WordPress admin access |
| Admin account created | Persistent backdoor independent of XSS |
| Customer data exposed | WooCommerce orders, addresses, payment data at risk |
Remediation
Step 1: Deactivate and Remove the Plugin
No patched version is currently available. Remove the plugin immediately.
# Via WP-CLI
wp plugin deactivate platnosci-blue-media
wp plugin delete platnosci-blue-mediaOr via WordPress admin: Plugins > Installed Plugins > Platnosci Online Blue Media (Autopay) > Deactivate > Delete.
Step 2: Remove Stored Payload
If the plugin has already been exploited, the malicious payload is stored in the WordPress options table and must be manually removed:
# Search for the malicious option
wp option get bm_woocommerce_css_editor_content
# If it contains suspicious script tags, delete or clear it
wp option update bm_woocommerce_css_editor_content ""Step 3: Audit Admin Sessions and Accounts
# Check for unauthorized administrator accounts
wp user list --role=administrator
# Review recent user registrations
wp user list --orderby=registered --order=DESC --number=20
# Invalidate all active sessions by rotating secret keys
wp config shuffle-saltsStep 4: Content Security Policy
Implement a Content Security Policy header to limit script execution sources:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";Detection Indicators
| Indicator | Description |
|---|---|
bm_woocommerce_css_editor_content option containing <script> tags | Stored XSS payload present |
| Unauthorized POST requests to Autopay CSS editor endpoint | Exploitation attempt |
| Unexpected admin account creations in access logs | Post-XSS privilege escalation |
| Outbound requests from admin browsers to unknown domains | Session token exfiltration |
| Suspicious changes to WooCommerce payment settings | Post-compromise manipulation |
Post-Remediation Checklist
- Remove the Autopay plugin from all WordPress installations
- Clear the
bm_woocommerce_css_editor_contentoption from the database - Audit all administrator and shop manager accounts for unauthorized additions
- Rotate WordPress secret keys to invalidate all existing sessions
- Review WooCommerce payment gateway configurations for unauthorized changes
- Scan for other stored XSS payloads using a security plugin (Wordfence, Sucuri)
- Notify WooCommerce customers if payment or order data may have been accessed
- Implement a CSP header to reduce XSS blast radius going forward