CVE-2026-15002 is a stored cross-site scripting vulnerability in the Blue Media Autopay WordPress plugin (up to and including version 5.0.0). The vulnerability arises because the Css_Editor::handle_save() method is hooked to WordPress's 'init' action without capability checks, nonce verification, or input sanitization. The raw POST parameter 'bm_woocommerce_css_editor_content' is saved directly to the 'woocommerce_bluemedia_settings' option and later echoed inside a <style> block on the WooCommerce checkout page without output escaping. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the checkout page.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks on users visiting the WooCommerce checkout page. This can lead to the execution of arbitrary scripts, potentially resulting in session hijacking, credential theft, or other client-side attacks. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected POST parameter and consider disabling the plugin if possible. Monitor for updates from the vendor and apply official patches once released. Avoid using the vulnerable versions in production environments.