Stored Cross-Site Scripting Vulnerability in CarDealerPress Plugin for WordPress

CVE-2025-3860

What is CVE-2025-3860?

The CarDealerPress plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient sanitization of the 'saleclass' parameter. Authenticated users with Contributor-level access can exploit this vulnerability to inject arbitrary scripts, leading to the execution of malicious code whenever a page containing the injected script is accessed. This poses a significant risk as it could compromise user sessions and lead to unauthorized access to sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References