Stored XSS Vulnerability in Platnosci Online Blue Media Plugin

The Platnosci Online Blue Media (Autopay) plugin for WordPress (versions 5.0.0 and below) contains a critical stored Cross-Site Scripting (XSS) vulnerability. The flaw originates in the Css_Editor::handle_save() method, which is improperly registered to the WordPress 'init' hook via Settings_Manager::init_once(). This method fails to implement necessary capability checks, nonce verification, or input sanitization on the 'bm_woocommerce_css_editor_content' POST parameter. Consequently, the plugin stores raw user-provided input directly into the 'woocommerce_bluemedia_settings' database option.

When a user visits the WooCommerce checkout page, the Css_Frontend::print_to_wp_head() function retrieves this stored value and echoes it directly into a <style> block without output escaping. An unauthenticated attacker can leverage this injection point to execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the site user. The scope of this threat is significant given the plugin's integration into the checkout process, which is a high-value target for attackers.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code in the browser context of any user viewing the WooCommerce checkout page. This can lead to full site administrative compromise if a site administrator views the page, or the theft of customer session cookies and sensitive checkout information. The vulnerability affects all WordPress installations utilizing the Platnosci Online Blue Media plugin up to version 5.0.0.

Recommendation

Prioritized, concrete actions for detection and remediation:

• Update the Platnosci Online Blue Media (Autopay) plugin to the latest available version beyond 5.0.0 immediately.
• Deploy WAF rules to inspect HTTP POST requests for the 'bm_woocommerce_css_editor_content' parameter to detect script-like payloads (e.g., <script>, javascript:, or event handlers).
• Implement access control list (ACL) restrictions at the web server level to limit access to the endpoints responsible for updating settings if the plugin functionality is not strictly required.
• Review web server access logs for anomalous POST requests targeting the WordPress site with the identified parameter.