MC
Product
Motors – Car Dealership & Classified Listings Plugin
14
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Motors – Car Dealership & Classified Listings Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2807 | 8.8 | Apr 8 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation Affected: through 1.4.64 |
| CVE-2026-3892 | 8.1 | May 14 | Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Affected: through 1.4.107 |
| CVE-2025-10494 | 8.1 | Oct 8 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion Affected: through 1.4.89 |
| CVE-2026-6806 | 7.5 | Sep 30 | Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters Affected: through 1.4.109 |
| CVE-2026-13114 | 7.2 | Jul 11 | Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info Affected: through 1.4.112 |
| CVE-2026-96563 | 6.4 | Oct 10 | Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter Affected: through 1.4.124 |
| CVE-2025-2808 | 5.4 | Apr 8 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 1.4.63 |
| CVE-2024-10970 | 5.4 | Jan 16 | Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Affected: through 1.4.43 |
| CVE-2026-16750 | 5.3 | Sep 17 | Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure Affected: through 1.4.120 |
| CVE-2024-5545 | 5.3 | Jul 2 | Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization Affected: through 1.4.9 |
| CVE-2026-12435 | 4.3 | Jul 1 | Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter Affected: through 1.4.111 |
| CVE-2026-1934 | 4.3 | May 12 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter Affected: through 1.4.103 |
| CVE-2025-3437 | 4.3 | Apr 8 | Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up Affected: through 1.4.66 |
| CVE-2024-13737 | 4.3 | Mar 22 | Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Affected: through 1.4.57 |
Showing 14