Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-13114

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress-extensions
Products
Motors Motors
CVE-2026-104746

Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stm_user_avatar_path meta is writable by any logged-in user against their own account.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress-extensions
Products
Motors Motors
CVE-2026-104399

WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress-extensions
Products
Motors Motors
CVE-2026-54812

WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-66693

WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors <= 1.4.113 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-39515

WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors < 1.4.107 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-54828

WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2026-54814

WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2025-54691

WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through <= 1.4.80.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2025-10494

Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress