Executive brief
The Autopay WordPress plugin for WooCommerce payment processing fails to validate or sanitize user input when saving styling options, allowing attackers to inject malicious JavaScript that executes when any customer or administrator views the checkout page. An attacker can inject persistent malicious code without authentication, potentially stealing payment information, session credentials, or hijacking administrator accounts.
Technical details
The plugin contains a stored cross-site scripting (XSS) vulnerability in its CSS editor functionality. The vulnerability exists because the plugin does not validate capability checks or nonce tokens before accepting CSS styling options from POST requests, and fails to escape the stored value when rendering it on the checkout page. An unauthenticated attacker can POST malicious JavaScript embedded in CSS to the checkout page URL, which is persisted to the gateway option and automatically enabled. The injected script executes in the browser of all visitors who load the checkout page, including administrators, enabling credential theft, session hijacking, or malware distribution. The vulnerability has been patched in version 5.0.1.
Affected products
- Autopay Autopay / Blue Media for WooCommerce before 5.0.1
Timeline
- 2026-08-07: disclosed
- 2026-08-10: advisory: CVE-2026-14293 published
- 2026-08-10: patched: Fixed in version 5.0.1