Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export

Wordfence Intelligence   >   Vulnerability Database   >   Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export
6.5
Insufficient Verification of Data Authenticity
CVE CVE-2019-17228
CVSS 6.5 (Medium)
Publicly Published September 20, 2019
Last Updated December 5, 2022
Researcher Jerome Bruandet - NinTechNet

Description

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated plugin settings changes, including the ability to add malicious JavaScript to a site.

Wordfence blocked 3,715 attacks targeting this vulnerability in the past 24 hours.

References

Share

Vulnerability Details for Motors – Car Dealership & Classified Listings Plugin

Motors – Car Dealership & Classified Listings Plugin

Software Type Plugin
Software Slug motors-car-dealership-classified-listings (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.4.1, or a newer patched version
Affected Version
  • < 1.4.1
Patched Version
  • 1.4.1

Recent vulnerabilities in Motors – Car Dealership & Classified Listings Plugin

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
7.2
CVE-2026-13114
Jul 10, 2026
Researcher: Webbernaut
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
4.3
CVE-2026-12435
Jun 30, 2026
Researcher: Michael Perla (vizen5)
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
4.3
CVE-2026-7859
Jun 22, 2026
Researcher: Mustafa
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
5.3
CVE-2026-54828
Jun 17, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-54814
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection
7.5
CVE-2026-54812
Jun 17, 2026
Researcher: endy
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
8.1
CVE-2026-3892
May 13, 2026
Researcher: Leonid Semenenko (lsemenenko)
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
4.3
CVE-2026-1934
May 11, 2026
Researcher: shrikant bhosale
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization
4.3
CVE-2026-39515
Apr 21, 2026
Researcher: Jakub Herman
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-10494
Oct 7, 2025
Researcher: Kishan Vyas
# Title CVE ID CVSS Researchers Date
1 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info CVE-2026-13114 7.2 Webbernaut July 10, 2026
2 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter CVE-2026-12435 4.3 Michael Perla (vizen5) June 30, 2026
3 Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery CVE-2026-7859 4.3 Mustafa June 22, 2026
4 Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization CVE-2026-54828 5.3 Nguyen Dinh Hai (HaiND) June 17, 2026
5 Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion CVE-2026-54814 7.5 endy June 17, 2026
6 Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection CVE-2026-54812 7.5 endy June 17, 2026
7 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter CVE-2026-3892 8.1 Leonid Semenenko (lsemenenko) May 13, 2026
8 Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter CVE-2026-1934 4.3 shrikant bhosale May 11, 2026
9 Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization CVE-2026-39515 4.3 Jakub Herman April 21, 2026
10 Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-10494 8.1 Kishan Vyas October 7, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation