The Autopay plugin for WordPress is vulnerable to stored XSS in versions up to 5.0.0. The flaw arises from the Css_Editor::handle_save() method, which registers on the WordPress init hook without a capability check, nonce verification, or input sanitization. The raw user input is written directly to the woocommerce_bluemedia_settings option and later echoed inside a <style> tag on the checkout page with no escaping. This enables attackers to inject arbitrary JavaScript that will run when any user loads the checkout page.

The vulnerability affects the Bluemedia Autopay plugin for WordPress, specifically versions 5.0.0 and earlier.

The CVSS score of 7.2 indicates a moderate to high risk, and the flaw is not listed in the CISA KEV catalog, with no EPSS data available. Because the attack vector requires no authentication, any external user can submit the malicious bm_woocommerce_css_editor_content POST parameter and persist the payload. Once stored, the script executes for every user visiting the compromised checkout page, potentially leading to session hijacking, defacement, or malicious redirection.