Motors – Car Dealership & Classified Listings Plugin

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Motors – Car Dealership & Classified Listings Plugin

Information

Software Type Plugin
Software Slug motors-car-dealership-classified-listings (view on wordpress.org)
Software Status Active
Software Author stylemix
Software Website wordpress.org
Software Downloads 267,246
Software Active Installs 9,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 34 Vulnerabilities

Submit a Vulnerability
Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
6.4
CVE-2026-96563
Oct 9, 2026
Researcher: Kamil B.
Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure
5.3
CVE-2026-104399
Oct 5, 2026
Researcher: Ananda Dhakal
Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting
6.4
CVE-2026-91022
Sep 30, 2026
Researcher: Yaswanth Reddy Sunkara
Motors – Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization
4.3
CVE-2026-91023
Sep 30, 2026
Researcher: Yaswanth Reddy Sunkara
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
7.5
CVE-2026-6806
Sep 29, 2026
Researcher: Leonid Semenenko (lsemenenko)
Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
5.3
CVE-2026-16750
Sep 17, 2026
Researchers: Niv Kochan, Matan Bachar
Motors <= 1.4.120 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-91016
Sep 15, 2026
Researcher: Pedro Pinho
Motors – Car Dealership & Classified Listings Plugin <= 1.4.113 - Missing Authorization
4.3
CVE-2026-66693
Aug 10, 2026
Researcher: Mohamed Bassia
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
7.2
CVE-2026-13114
Jul 10, 2026
Researcher: Webbernaut
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
4.3
CVE-2026-12435
Jun 30, 2026
Researcher: Michael Perla (vizen5)
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
4.3
CVE-2026-7859
Jun 22, 2026
Researcher: Mustafa
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection
7.5
CVE-2026-54812
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-54814
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
5.3
CVE-2026-54828
Jun 17, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
8.1
CVE-2026-3892
May 13, 2026
Researcher: Leonid Semenenko (lsemenenko)
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
4.3
CVE-2026-1934
May 11, 2026
Researcher: shrikant bhosale
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization
4.3
CVE-2026-39515
Apr 21, 2026
Researcher: Jakub Herman
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-10494
Oct 7, 2025
Researcher: hashiramasenju333
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2025-54691
Jul 30, 2025
Researcher: Bao - BlueRock
Motors <= 1.4.71 - Unauthenticated Local File Inclusion
9.8
CVE-2025-32654
Apr 9, 2025
Researcher: LVT-tholv2k
Title Status CVE ID CVSS Researchers Date
Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter Unpatched CVE-2026-96563 6.4 Kamil B. October 9, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure Patched CVE-2026-104399 5.3 Ananda Dhakal October 5, 2026
Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting Patched CVE-2026-91022 6.4 Yaswanth Reddy Sunkara September 30, 2026
Motors – Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization Patched CVE-2026-91023 4.3 Yaswanth Reddy Sunkara September 30, 2026
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters Patched CVE-2026-6806 7.5 Leonid Semenenko (lsemenenko) September 29, 2026
Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure Patched CVE-2026-16750 5.3 Niv Kochan, Matan Bachar September 17, 2026
Motors <= 1.4.120 - Unauthenticated Insecure Direct Object Reference Patched CVE-2026-91016 5.3 Pedro Pinho September 15, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.113 - Missing Authorization Patched CVE-2026-66693 4.3 Mohamed Bassia August 10, 2026
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info Patched CVE-2026-13114 7.2 Webbernaut July 10, 2026
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter Patched CVE-2026-12435 4.3 Michael Perla (vizen5) June 30, 2026
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery Patched CVE-2026-7859 4.3 Mustafa June 22, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection Patched CVE-2026-54812 7.5 endy June 17, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion Patched CVE-2026-54814 7.5 endy June 17, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization Patched CVE-2026-54828 5.3 Nguyen Dinh Hai (HaiND) June 17, 2026
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Patched CVE-2026-3892 8.1 Leonid Semenenko (lsemenenko) May 13, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter Patched CVE-2026-1934 4.3 shrikant bhosale May 11, 2026
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization Patched CVE-2026-39515 4.3 Jakub Herman April 21, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2025-10494 8.1 hashiramasenju333 October 7, 2025
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference Patched CVE-2025-54691 5.3 Bao - BlueRock July 30, 2025
Motors <= 1.4.71 - Unauthenticated Local File Inclusion Patched CVE-2025-32654 9.8 LVT-tholv2k April 9, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation