VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Motors – Car Dealership & Classified Listings Plugin security & vulnerabilities

motors-car-dealership-classified-listings— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 41 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
41Known vulnerabilities
  • Critical2
  • High12
  • Medium27
  • Low0
Vulnerabilities per year
2019: 2 vulnerabilities2192022: 1 vulnerability1222023: 3 vulnerabilities3232024: 1 vulnerability1242025: 10 vulnerabilities10252026: 24 vulnerabilities2426

All Motors – Car Dealership & Classified Listings Plugin vulnerabilities

Motors – Car Dealership & Classified Listings Plugin vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
≤1.4.128Update to 1.4.129
CVE-2026-123467
Medium4.3Missing Authorization
≤1.4.128Update to 1.4.129
CVE-2026-123468
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤1.4.128Update to 1.4.129
CVE-2026-66675
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
≤1.4.125Update to 1.4.126
CVE-2026-104746
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
≤1.4.128Update to 1.4.129
CVE-2026-116562
High8.1Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
≤1.4.128Update to 1.4.129
CVE-2026-116617
High7.5Unauthenticated SQL Injection
≤1.4.126Update to 1.4.127
CVE-2026-115964
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
≤1.4.124Update to 1.4.125
CVE-2026-96563
Medium5.3Unauthenticated Information Exposure
≤1.4.124Update to 1.4.125
CVE-2026-104399
Medium6.4Authenticated (Listing Manager+) Stored Cross-Site Scripting
≤1.4.123Update to 1.4.124
CVE-2026-91022
Medium4.3Missing Authorization
≤1.4.123Update to 1.4.124
CVE-2026-91023
High7.5Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
≤1.4.109Update to 1.4.110
CVE-2026-6806
Medium5.3Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
≤1.4.120Update to 1.4.121
CVE-2026-16750
Medium5.3Unauthenticated Insecure Direct Object Reference
≤1.4.120Update to 1.4.121
CVE-2026-91016
Medium4.3Missing Authorization
≤1.4.113Update to 1.4.114
CVE-2026-66693
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
≤1.4.112Update to 1.4.113
CVE-2026-13114
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
≤1.4.111Update to 1.4.112
CVE-2026-12435
Medium4.3Cross-Site Request Forgery
<1.4.110Update to 1.4.110
CVE-2026-7859
Medium5.3Missing Authorization
≤1.4.109Update to 1.4.110
CVE-2026-54828
High7.5Unauthenticated SQL Injection
≤1.4.109Update to 1.4.110
CVE-2026-54812
High7.5Authenticated (Subscriber+) Local File Inclusion
≤1.4.109Update to 1.4.110
CVE-2026-54814
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
≤1.4.107Update to 1.4.108
CVE-2026-3892
Medium4.3Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
≤1.4.103Update to 1.4.104
CVE-2026-1934
Medium4.3Missing Authorization
<1.4.107Update to 1.4.107
CVE-2026-39515
High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤1.4.89Update to 1.4.90
CVE-2025-10494
Medium5.3Unauthenticated Insecure Direct Object Reference
≤1.4.80Update to 1.4.81
CVE-2025-54691
Critical9.8Unauthenticated Local File Inclusion
≤1.4.71Update to 1.4.72
CVE-2025-32654
High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
≤1.4.64Update to 1.4.65
CVE-2025-2807
Medium4.3Missing Authorization to Authenticated (Subscriber+) Wizard Set-up
≤1.4.66Update to 1.4.67
CVE-2025-3437
Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤1.4.63Update to 1.4.64
CVE-2025-2808
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.71Update to 1.4.72
CVE-2025-32170
High8.8Authenticated (Contributor+) Local File Inclusion
≤1.4.71Update to 1.4.72
CVE-2025-32142
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation
≤1.4.57Update to 1.4.58
CVE-2024-13737
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title
≤1.4.43Update to 1.4.44
CVE-2024-10970
Medium5.3Missing Authorization
≤1.4.9Update to 1.4.11
CVE-2024-5545
Medium6.1Reflected Cross-Site Scripting
≤1.4.6Update to 1.4.7
CVE-2023-46208
High7.2Server Side Request Forgery
≤1.4.6Update to 1.4.7
CVE-2023-46207
Medium5.4Cross-Site Request Forgery via Multiple Functions
≤1.4.5Update to 1.4.6
CVE-2022-38716
Critical9.8Unauthenticated Arbitrary File Upload
≤1.4.3Update to 1.4.4
CVE-2022-3989
Medium6.1Stored Cross-Site Scripting
<1.4.1Update to 1.4.1
CVE-2019-17229
Medium6.5Unauthenticated Settings Import/Export
<1.4.1Update to 1.4.1
CVE-2019-17228

Motors – Car Dealership & Classified Listings Plugin: common questions

Does Motors – Car Dealership & Classified Listings Plugin have known vulnerabilities?

Yes. VulnCrest Radar lists 41 known vulnerabilities in Motors – Car Dealership & Classified Listings Plugin: 2 critical, 12 high, 27 medium. None are known to affect version null.

How do I check which version of Motors – Car Dealership & Classified Listings Plugin I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Motors – Car Dealership & Classified Listings Plugin vulnerability?

CVE-2026-123467, published Nov 7, 2026: Motors – Car Dealership & Classified Listings Plugin <= 1.4.128 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any Motors – Car Dealership & Classified Listings Plugin vulnerability listed in CISA KEV?

No. None of the known Motors – Car Dealership & Classified Listings Plugin vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?