Motors

A Subscriber or higher can submit script-bearing stm_f_s to stm_ajax_add_a_car in Motors through version 1.4.124. The necessary nonce is placed in wp_footer on every page and is not an authorization boundary. Insufficient input sanitization and output escaping preserve attacker input for later rendering, enabling stored script in a viewer's browser. The export does not identify the victim's role.

No attacker login is required. An attacker can obtain data that should not be exposed in the reachable response. The specific data fields, endpoint and request parameters are undisclosed. The supplied vector reports limited confidentiality impact. The vector requires no victim interaction. Affected versions: <= 1.4.124. The authoritative export identifies 1.4.125 as fixed for this CVE.

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the plugin's paid featured-listing option is enabled, neither of which is a default configuration. No further endpoint or implementation detail is disclosed beyond the path described here. The authoritative export identifies the fixed release as 1.4.124.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator. No further endpoint or implementation detail is disclosed beyond the path described here. The authoritative export identifies the fixed release as 1.4.124.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Motors – Car Dealership & Classified Listings Plugin through 1.4.120 lacks authorization checks in mvl_ajax_dealer_load_cars(). An unauthenticated caller can cause this handler to return draft, pending, private and future car listings belonging to arbitrary users. Attacker-directed listing retrieval therefore crosses the publication-status and owner boundaries that should protect non-public content. The export does not name the request action, parameter used to select a user, or complete returned fields. It establishes disclosure of unpublished listings, not modification of those listings or arbitrary database access.

Motors before 1.4.121, an unauthenticated requester can supply a numeric user ID and receive that author's draft, pending and private car listings without authorization. Returned fields include titles, prices, media URLs and seller notes. The export does not name the request route, user-ID parameter or listing-query function. This record concerns the Motors WordPress plugin, not the similarly named theme.

Motors is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.4.113.

Motors – Car Dealership & Classified Listings Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.4.112.

Motors – Car Dealership & Classified Listings Plugin is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.4.111.

Motors is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.4.109.

Motors is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.4.109.

Motors is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is n/a through 1.4.109.

Motors is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 1.4.107.

Motors – Car Dealership & Classified Listings Plugin is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.4.103.

Motors is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Motors is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Motors is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Motors is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Motors – Car Dealer, Classifieds & Listing is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

The Motors – Car Dealer, Classifieds & Listing is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Motors – Car Dealer, Classifieds & Listing is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Motors Car Dealership Classified Listings is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Motors Car Dealership Classified Listings is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Motors Car Dealership Classified Listings is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Motors Car Dealership Classified Listings is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.