CVE-2026-14293 is a stored cross-site scripting (XSS) vulnerability in the Autopay WordPress plugin prior to version 5.0.1. The vulnerability arises from the plugin's failure to verify user capabilities or use nonce checks before saving styling options submitted via public requests. Additionally, the plugin does not escape these values when rendering them on the checkout page. This combination allows unauthenticated attackers to inject malicious JavaScript code that executes in the context of any user viewing the checkout page, potentially leading to session hijacking or other client-side attacks.

An unauthenticated attacker can store malicious JavaScript in the plugin's styling options, which will execute in the browsers of any users who load the checkout page, including administrators. This can lead to client-side attacks such as session hijacking, credential theft, or unauthorized actions performed with the privileges of the affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's settings and avoid exposing the checkout page to untrusted users. Monitor official Autopay plugin channels for updates and apply any released patches promptly.