The Autopay WordPress plugin, used in WooCommerce sites, fails to verify user capabilities or provide a nonce when a styling option is saved via the public CSS editor. It also fails to escape that option before rendering it on the checkout page, which allows an unauthenticated attacker to inject arbitrary JavaScript that will run when any user, including site administrators, visits the checkout page.

WordPress sites running the Autopay plugin (Blue Media for WooCommerce) version 4.x or earlier, i.e., any release prior to 5.0.1.

Because the flaw is an unauthenticated stored XSS, it is exploitable directly through a web request to the plugin’s CSS editor endpoint. An attacker can register arbitrary JavaScript that will execute in the browsers of all individuals who load the checkout page, potentially compromising user sessions, defacing the site, or stealing credentials. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the absence of access controls and input sanitization suggests a high risk of exploitation.