CVE-2026-15002: Improper Neutralization of Input During Web Page Generation

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

PT-2026-73087

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm woocommerce css editor content' POST parameter. This is due to the Css Editor::handle save method being wired to the WordPress 'init' hook ...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

EUVD-2026-54994

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293

The Autopay WordPress plugin (also known as Blue Media for WooCommerce ) versions prior to 5.0.1 is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a failure to perform capability or nonce checks before saving a styling option from a public request, combined wi...

PT-2026-69344

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the software fails to perform capability or nonce checks before saving a styling option from a public request. Additionally, the saved value is not escaped when...

CVE-2026-14293: Improper Neutralization of Input During Web Page Generation

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-57425

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

CVE-2026-57425

CVE-2026-57425 affects the WordPress plugin Autopay dla WooCommerce (versions

CVE-2026-57425 WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

CVE-2026-57425 WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

EUVD-2026-48168

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

CVE-2026-57425: Missing Authorization

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

PT-2026-63826

Unauthenticated Broken Access Control in Autopay dla WooCommerce = 2.2.27 versions...

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Autopay dla WooCommerce versions = 2.2.27...

GPlayed's younger brother is a banker — and it's after Russian banks

This blog post is authored by Vitor Ventura. Introduction Cisco Talos published its findings on a new Android trojan known as "GPlayed" on Oct. 11. At the time, we wrote that the trojan seemed to be in the testing stages of development, based on the malware's code patterns, strings and telemetry...

ticketnara.co.kr XSS vulnerability

Vulnerable URL: https://www.ticketnara.co.kr/TicketNara/AutoPay/AutoPayPopUp.jsp?MEMBERNAME=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...