CVE-2026-96563
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to and including 1.4.123 due to insufficient input sanitization and output escaping.
Risk Assessment
An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute for any visitor. This can lead to session theft or account takeover.
Recommendation
Update the Motors plugin to a version newer than 1.4.123 as soon as it is available, and consider restricting subscriber registration.
Other vulnerabilities in Motors
See all- CVE-2026-54828High
Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.
- CVE-2026-54812Critical
SQL Injection vulnerability in the Motors (motors-car-dealership-classified-listings) plugin by StylemixThemes allows an attacker to perform blind SQL injection. The issue affects versions from n/a through 1.4.109.
- CVE-2026-93950High
The Motors plugin by StylemixThemes is vulnerable to Missing Authorization in versions up to and including 1.4.108, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-104399Medium
The Motors plugin by StylemixThemes in versions up to and including 1.4.124 contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data.
- CVE-2026-91023Low
The Motors WordPress plugin before version 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions. This allows authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors plugin's paid featured-listing option is enabled, neither of which is a default configuration.
- CVE-2026-91022Medium
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
- CVE-2026-91016Medium
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.
- CVE-2026-66693Medium
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
- CVE-2026-27433Medium
The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.
- CVE-2026-39515Medium
Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.
Original NVD description (English source)
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS