Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-16 | 1 | Disclosure1 |
| 2026-08-17 | 2 | Disclosure1Patch1 |
CVE-2026-15002: unauthenticated stored XSS in a WooCommerce payment plugin. Every defense layer failed. Here's what to grep for in your own code:
Post summary
The post announces CVE-2026-15002, describing it as an unauthenticated stored XSS in a WooCommerce payment plugin, but does not provide PoC, exploit code, or patch information.
Wordfence published the full breakdown and the plugin changeset is public. This is a textbook example of what not to do. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-15002
Post summary
Wordfence has released the full breakdown of CVE-2026-15002 and made the plugin changeset public, signalling that a patch is available.
CVE-2026-15002 Stored XSS in WordPress Platnosci Online Blue Media Plugin Up To 5.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15002 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A vulnerability notification is posted, identifying a Stored XSS in WordPress Platnosci Online Blue Media Plugin up to version 5.0.0, with no exploitation, patch, or PoC details supplied.