CVE-2026-15002 is a stored cross-site scripting vulnerability in the Blue Media Autopay WordPress plugin (<=5.0.0). The Css_Editor::handle_save() method is hooked to WordPress 'init' without capability checks, nonce verification, or input sanitization. It writes the raw POST parameter 'bm_woocommerce_css_editor_content' directly to the 'woocommerce_bluemedia_settings' option. Later, Css_Frontend::print_to_wp_head() outputs this data inside a <style> block on the WooCommerce checkout page without escaping, enabling script injection that executes in the context of users visiting that page.

An unauthenticated attacker can inject arbitrary JavaScript code into the WooCommerce checkout page, potentially leading to session hijacking, credential theft, or other malicious actions executed in the context of the victim's browser. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the POST parameter 'bm_woocommerce_css_editor_content' and disable or remove the vulnerable plugin version. Monitor for updates from the vendor and apply official patches once released. Avoid using affected versions (<=5.0.0) in production environments.