{"id":"CVE-2026-116562","published":"2026-11-07T03:16:59.963","lastModified":"2026-11-07T18:17:12.660","description":"The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s[make]' parameter in all versions up to, and including, 1.4.128 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Free Listing Submission feature to be enabled, which is shipped on by default via the Setup Wizard demo configuration.","cvssScore":6.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/functions.php#L1537","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/vehicle_functions.php#L1089","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/vehicle_functions.php#L1435","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/elementor/Widgets/single-listing/gallery.php#L77","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/listing-cars/listing-list-directory-edit-loop.php#L114","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/listing-cars/listing-list-directory-edit-loop.php#L119","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3774780/motors-car-dealership-classified-listings/trunk/templates/elementor/Widgets/single-listing/gallery.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f11a49c-f352-4ae8-bad9-b55b2ef76353?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}