CVE-2026-15002
Received Received - Intake

Stored XSS in Platnosci Online Blue Media WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-15002
EUVD
EUVD-2026-59868

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
blue_media platnosci_online_blue_media to 5.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Platnosci Online Blue Media WordPress plugin up to version 5.0.0. It allows unauthenticated attackers to inject malicious scripts via the 'bm_woocommerce_css_editor_content' POST parameter. The plugin saves raw user input without sanitization or validation, then displays it unsafely on the WooCommerce checkout page, enabling script execution when users visit the page.

Detection Guidance

Check WordPress sites using the Platnosci Online Blue Media plugin for versions up to 5.0.0. Inspect POST requests to the 'bm_woocommerce_css_editor_content' parameter. Look for unauthorized script injections in WooCommerce checkout pages or 'woocommerce_bluemedia_settings' option values.

Impact Analysis

Attackers could steal user session cookies, redirect users to malicious sites, or perform actions on their behalf. Since the checkout page is commonly accessed by customers, this could lead to account takeovers, financial fraud, or data theft. The impact depends on user privileges and the sensitivity of data processed on the site.

Compliance Impact

This vulnerability could violate GDPR by exposing user data or enabling unauthorized access to personal information. For HIPAA, it may risk protected health information if processed on the site. Non-compliance may lead to fines or legal penalties depending on the data involved and applicable regulations.

Mitigation Strategies

Update the Platnosci Online Blue Media plugin to the latest version. Remove or disable the plugin if no update is available. Implement strict input validation for POST parameters. Add capability checks and nonce verification to sensitive functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart