WordPress security changelog
MEDIUM CVE-2026-96563 Deferred

Motors – Car Dealership & Classified Listings Plugin: Cross-site scripting

A Subscriber or higher can submit script-bearing stm_f_s to stm_ajax_add_a_car in Motors through version 1.4.124. The necessary nonce is placed in wp_footer on every page and is not an authorization boundary. Insufficient input sanitization and output escaping preserve attacker input for later rendering, enabling stored script in a viewer's browser. The export does not identify the victim's role.

CVE / CNA score 6.4 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Motors – Car Dealership & Classified Listings Plugin
Plugin slug
motors-car-dealership-classified-listings
Affected
<= 1.4.124
Safe version
See mitigation notes
Published
Oct 10, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 10, 2026 and is one of 26 known issues for this plugin.

What to do

Update, patch or deactivate.

Official author notes reviewed on 2026-10-24 through version 1.4.126 do not establish a fixed version for this CVE. The latest identified security fix concerns arbitrary file deletion through an avatar path, not stm_f_s stored XSS. This archive's uncertainty does not establish that the current release remains vulnerable. Restrict or disable the affected listing-submission feature where warranted. Enforce the intended listing-management capability, sanitize submitted fields, escape stm_f_s in its final output context, and review stored listing content for injected script. Official notes: https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources