CVE-2026-14293

The Autopay WordPress plugin (before 5.0.1) is affected. The root cause is lack of capability/nonce checks when saving a styling option from a public request and lack of escaping on output on the checkout page, enabling unauthenticated attackers to store JavaScript that executes in any user’s bro...