Platnosci Online Blue Media Vulnerabilities

The Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user a...

CVSS:

7.2

Affected:

up to 5.0.0

Fixed in:

5.0.1

Disclosed:

Aug 18, 2026

CVE-2026-73338 on NVD →

The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager...

CVSS:

7.2

Affected:

up to 5.0.0

Fixed in:

5.0.1

Disclosed:

Aug 15, 2026

CVE-2026-15002 on NVD →

The Autopay / Blue Media for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute w...

CVSS:

7.2

Affected:

up to 5.0.0

Fixed in:

5.0.1

Disclosed:

Aug 7, 2026

CVE-2026-14293 on NVD →