The Autopay WordPress plugin prior to version 5.0.1 contains a stored Cross-Site Scripting (CWE-79) vulnerability. Specifically, it does not validate user capabilities or verify nonces before saving a styling option submitted via a public request. Furthermore, the plugin fails to properly escape this stored value when rendering it on the checkout page. As a result, unauthenticated attackers can inject arbitrary JavaScript code that executes in the context of any user loading the checkout page, potentially leading to full compromise of user sessions and site integrity.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of any users visiting the checkout page, including administrators. This can lead to theft of credentials, session hijacking, and other high-impact consequences affecting confidentiality, integrity, and availability of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the checkout page and monitor for suspicious activity. Avoid using affected versions of the Autopay plugin in public-facing environments.