https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 12:30:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354410 EUVD-2026-354410 https://cve.radiocsirt.org/vuln/euvd-2026-354410 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15002 <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15002 https://cve.radiocsirt.org/vuln/ghsa-5c8g-gwg5-j775 <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> <p>The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the &#39;bm_woocommerce_css_editor_content&#39; POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress &#39;init&#39; hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the &#39;woocommerce_bluemedia_settings&#39; option via update_option(), then later echoed directly inside a &lt;style&gt; block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).</p> https://cve.radiocsirt.org/vuln/ghsa-5c8g-gwg5-j775