CVE-2026-14293

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Autopay WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-14293

EUVD

EUVD-2026-54994

Affected Vendors & Products

Vendor	Product	Version / Range
autopay	autopay	to 5.0.1 (exc)
blue_media	autopay	to 5.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Autopay WordPress plugin before version 5.0.1 has a stored cross-site scripting (XSS) vulnerability. It allows unauthenticated attackers to inject malicious JavaScript by exploiting missing capability and nonce checks when saving styling options. This injected script executes in the browsers of any user, including administrators, who visit the checkout page.

Detection Guidance

Check if the Autopay WordPress plugin version is below 5.0.1 by inspecting the plugin files or WordPress admin panel. Look for unauthorized JavaScript in the CSS Editor settings or checkout page output.

Impact Analysis

This vulnerability allows attackers to steal sensitive user data like session cookies or login credentials by executing malicious scripts in the browser of anyone visiting the checkout page. It could also enable attackers to perform actions on behalf of users or administrators without their consent.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing user data through unauthorized script execution. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update the Autopay plugin to version 5.0.1 or later immediately. Remove any suspicious JavaScript from the CSS Editor settings and review checkout page output for unauthorized code.

Hi! I’m here to help you understand CVE-2026-14293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70