CVE-2026-15002

The CVE-2026-15002 entry concerns the Platnosci Online Blue Media (Autopay) WordPress plugin. A Stored XSS exists in versions up to 5.0.0 via the bm_woocommerce_css_editor_content POST parameter. The root cause is Css_Editor::handle_save() being wired to WordPress 'init' by Settings_Manager::init...