Motors – Car Dealership & Classified Listings Plugin vulnerabilities

Product

Motors – Car Dealership & Classified Listings Plugin

by stylemix · last CVE Oct 10, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 0High 5Medium 9Low 0

Severity

All severities14 Critical0 High5 Medium9 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Motors – Car Dealership & Classified Listings Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-96563	6.4	0%	Oct 10	Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter Affected: through 1.4.124
CVE-2025-2808	5.4	0%	Apr 8	Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 1.4.63
CVE-2024-10970	5.4	0%	Jan 16	Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Affected: through 1.4.43
CVE-2026-16750	5.3	0%	Sep 17	Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure Affected: through 1.4.120
CVE-2024-5545	5.3	0%	Jul 2	Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization Affected: through 1.4.9
CVE-2026-12435	4.3	0%	Jul 1	Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter Affected: through 1.4.111
CVE-2026-1934	4.3	0%	May 12	Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter Affected: through 1.4.103
CVE-2025-3437	4.3	0%	Apr 8	Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up Affected: through 1.4.66
CVE-2024-13737	4.3	0%	Mar 22	Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Affected: through 1.4.57