WordPress plugin
Motors – Car Dealership & Classified Listings Plugin security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 41 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High12
- Medium27
- Low0
All Motors – Car Dealership & Classified Listings Plugin vulnerabilities
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
≤1.4.125Update to 1.4.126
- High8.1Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
≤1.4.128Update to 1.4.129
- High7.5Unauthenticated SQL Injection
≤1.4.126Update to 1.4.127
- High7.5Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
≤1.4.109Update to 1.4.110
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
≤1.4.112Update to 1.4.113
- High7.5Unauthenticated SQL Injection
≤1.4.109Update to 1.4.110
- High7.5Authenticated (Subscriber+) Local File Inclusion
≤1.4.109Update to 1.4.110
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
≤1.4.107Update to 1.4.108
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤1.4.89Update to 1.4.90
- Critical9.8Unauthenticated Local File Inclusion
≤1.4.71Update to 1.4.72
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
≤1.4.64Update to 1.4.65
- High8.8Authenticated (Contributor+) Local File Inclusion
≤1.4.71Update to 1.4.72
- High7.2Server Side Request Forgery
≤1.4.6Update to 1.4.7
- Critical9.8Unauthenticated Arbitrary File Upload
≤1.4.3Update to 1.4.4
Motors – Car Dealership & Classified Listings Plugin: common questions
Does Motors – Car Dealership & Classified Listings Plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 41 known vulnerabilities in Motors – Car Dealership & Classified Listings Plugin: 2 critical, 12 high, 27 medium. None are known to affect version null.
How do I check which version of Motors – Car Dealership & Classified Listings Plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Motors – Car Dealership & Classified Listings Plugin vulnerability?
CVE-2026-123467, published Nov 7, 2026: Motors – Car Dealership & Classified Listings Plugin <= 1.4.128 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any Motors – Car Dealership & Classified Listings Plugin vulnerability listed in CISA KEV?
No. None of the known Motors – Car Dealership & Classified Listings Plugin vulnerabilities is currently listed in the CISA KEV catalog.