CVE-2025-14042

MediumCVSS 6.4

Published: 29/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Automotive Car Dealership Business WordPress Theme is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items. The vulnerability is due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.

Risk Assessment

An attacker can inject a malicious script that executes in the browser of every visitor, potentially leading to session theft, redirects, or data theft.

Recommendation

Update the theme to version 13.4.2 or later which contains the fix. If an update is not available, temporarily disable editing of custom fields for low-privileged users.

Other vulnerabilities in WordPress Theme

CVE-2026-13423Critical
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes. This allows unauthenticated attackers to call arbitrary PHP functions with attacker-supplied arguments, leading to privilege escalation and remote code execution.

Original NVD description (English source)

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items in all versions up to, and including, 13.4.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'project_details' custom field. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.