An unauthenticated stored cross-site scripting vulnerability in the Autopay WordPress plugin allows attackers to execute malicious JavaScript in the browsers of users, including administrators.

The plugin fails to perform capability or nonce checks when saving styling options and does not properly escape these values upon output. This allows unauthenticated attackers to inject and store malicious JavaScript, which executes when a user, such as an administrator, views the checkout page.

With a CVSS score of 8.8, this vulnerability is highly dangerous as it allows for the theft of administrative session cookies, unauthorized transaction manipulation, and redirection of customers. The unauthenticated nature of the attack significantly increases the risk, as it requires no prior access to the WordPress dashboard to compromise the site.

Immediate Action: Update the Autopay WordPress plugin to version 5.0.1 or later immediately.

Proactive Monitoring: Inspect the checkout page source code for unexpected script tags and monitor for suspicious administrative login activity or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious XSS payloads in request parameters.

Public Exploit Available: No (no confirmed public exploit available).

This vulnerability represents a critical risk to the security of the checkout process and administrative sessions. Administrators must apply the patch to version 5.0.1 immediately to prevent malicious script injection and protect sensitive customer and administrative interactions on the site.