Motors – Car Dealership & Classified Listings Plugin

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Motors – Car Dealership & Classified Listings Plugin

Information

Software Type Plugin
Software Slug motors-car-dealership-classified-listings (view on wordpress.org)
Software Status Active
Software Author stylemix
Software Website wordpress.org
Software Downloads 231,653
Software Active Installs 9,000
Software Record Last Updated July 13, 2026

Showing 1-20 of 26 Vulnerabilities

Submit a Vulnerability
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
7.2
CVE-2026-13114
Jul 10, 2026
Researcher: Webbernaut
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
4.3
CVE-2026-12435
Jun 30, 2026
Researcher: Michael Perla (vizen5)
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
4.3
CVE-2026-7859
Jun 22, 2026
Researcher: Mustafa
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection
7.5
CVE-2026-54812
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-54814
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
5.3
CVE-2026-54828
Jun 17, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
8.1
CVE-2026-3892
May 13, 2026
Researcher: Leonid Semenenko (lsemenenko)
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
4.3
CVE-2026-1934
May 11, 2026
Researcher: shrikant bhosale
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization
4.3
CVE-2026-39515
Apr 21, 2026
Researcher: Jakub Herman
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-10494
Oct 7, 2025
Researcher: Kishan Vyas
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2025-54691
Jul 30, 2025
Researcher: Bao - BlueRock
Motors <= 1.4.71 - Unauthenticated Local File Inclusion
9.8
CVE-2025-32654
Apr 9, 2025
Researcher: LVT-tholv2k
Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
8.8
CVE-2025-2807
Apr 7, 2025
Researcher: mikemyers
Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting
5.4
CVE-2025-2808
Apr 7, 2025
Researcher: siavashvafshar
Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up
4.3
CVE-2025-3437
Apr 7, 2025
Researcher: Chloe Chamberland
Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-32142
Apr 4, 2025
Researcher: LVT-tholv2k
Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-32170
Apr 4, 2025
Researcher: LVT-tholv2k
Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation
4.3
CVE-2024-13737
Mar 21, 2025
Researcher: Thanh Nam Tran
Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title
5.4
CVE-2024-10970
Jan 15, 2025
Researchers: ghsinfosec, C_T_R_L
Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization
5.3
CVE-2024-5545
Jul 1, 2024
Researcher: Krzysztof Zając
Title Status CVE ID CVSS Researchers Date
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info Patched CVE-2026-13114 7.2 Webbernaut July 10, 2026
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter Patched CVE-2026-12435 4.3 Michael Perla (vizen5) June 30, 2026
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery Patched CVE-2026-7859 4.3 Mustafa June 22, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection Patched CVE-2026-54812 7.5 endy June 17, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion Patched CVE-2026-54814 7.5 endy June 17, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization Patched CVE-2026-54828 5.3 Nguyen Dinh Hai (HaiND) June 17, 2026
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Patched CVE-2026-3892 8.1 Leonid Semenenko (lsemenenko) May 13, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter Patched CVE-2026-1934 4.3 shrikant bhosale May 11, 2026
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization Patched CVE-2026-39515 4.3 Jakub Herman April 21, 2026
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2025-10494 8.1 Kishan Vyas October 7, 2025
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference Patched CVE-2025-54691 5.3 Bao - BlueRock July 30, 2025
Motors <= 1.4.71 - Unauthenticated Local File Inclusion Patched CVE-2025-32654 9.8 LVT-tholv2k April 9, 2025
Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation Patched CVE-2025-2807 8.8 mikemyers April 7, 2025
Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2025-2808 5.4 siavashvafshar April 7, 2025
Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up Patched CVE-2025-3437 4.3 Chloe Chamberland April 7, 2025
Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-32142 8.8 LVT-tholv2k April 4, 2025
Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-32170 6.4 LVT-tholv2k April 4, 2025
Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Patched CVE-2024-13737 4.3 Thanh Nam Tran March 21, 2025
Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Patched CVE-2024-10970 5.4 ghsinfosec, C_T_R_L January 15, 2025
Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization Patched CVE-2024-5545 5.3 Krzysztof Zając July 1, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation