{"affected":[{"defaultStatus":"unaffected","product":"Motors – Car Dealership & Classified Listings Plugin","source":"CNA: Wordfence","vendor":"stylemix","versions":[{"lessThanOrEqual":"1.4.128","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-116562","cwes":["CWE-79"],"description":"The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s[make]' parameter in all versions up to, and including, 1.4.128 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Free Listing Submission feature to be enabled, which is shipped on by default via the Setup Wizard demo configuration.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794018550862,"publishedAt":1794018550862,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f11a49c-f352-4ae8-bad9-b55b2ef76353?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/vehicle_functions.php#L1435"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/elementor/Widgets/single-listing/gallery.php#L77"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/listing-cars/listing-list-directory-edit-loop.php#L114"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/templates/listing-cars/listing-list-directory-edit-loop.php#L119"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/functions.php#L1537"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.126/includes/vehicle_functions.php#L1089"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3774780/motors-car-dealership-classified-listings/trunk/templates/elementor/Widgets/single-listing/gallery.php"}],"remediation":[],"revision":"5a4d2a00be5eeab083385099007c0f046dafefab20361d32fcb1ad198d8d91fa","sources":[{"modifiedAt":1794018550862,"name":"CNA: Wordfence","retrievedAt":1794020905262,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116562"}],"ssvc":null,"status":"published","title":"Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter","updatedAt":1794020905262}