EUVD-2026-54994

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293

The Autopay WordPress plugin (before 5.0.1) is affected. The root cause is lack of capability/nonce checks when saving a styling option from a public request and lack of escaping on output on the checkout page, enabling unauthenticated attackers to store JavaScript that executes in any user’s bro...