WordPress Autopay plugin < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion vulnerability

Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion vulnerability discovered by Artus KG in WordPress Plugin Autopay versions 5.0.1...

CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

EUVD-2026-81350

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90923: Incorrect Authorization

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-73338

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73338 WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

EUVD-2026-60769

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73338

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73338 WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73338

The WordPress Autopay plugin (versions ≤ 5.0.0) has an unauthenticated reflected/stored XSS flaw, exploitable via a network request with no authentication. CVSS 7.1 (HIGH) reflects low confidentiality/integrity/availability impact. Exploitation details are not provided; update to a patched versio...

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Autopay versions = 5.0.0...

WordPress Autopay plugin <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'bmwoocommercecsseditorcontent' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Autopay versions = 5.0.0...

CVE-2026-73338: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

PT-2026-77084

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

CVE-2026-15002

The CVE-2026-15002 entry concerns the Platnosci Online Blue Media (Autopay) WordPress plugin. A Stored XSS exists in versions up to 5.0.0 via the bm_woocommerce_css_editor_content POST parameter. The root cause is Css_Editor::handle_save() being wired to WordPress 'init' by Settings_Manager::init...

CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...