CVE-2026-27425

The Automotive Listings plugin version 18.6 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows an attacker to inject a malicious script without requiring authentication.

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or perform other actions in the victim's browser context, potentially leading to data confidentiality and integrity breaches.

Immediately update the Automotive Listings plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.