Stored Cross-Site Scripting in Motors – Car Dealership & Classified Listings Plugin

CVE-2026-116562

What is CVE-2026-116562?

The Motors – Car Dealership & Classified Listings Plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'stm_f_s[make]' parameter. Authenticated users with subscriber-level access or higher can exploit this flaw to inject malicious web scripts into pages. The execution of these scripts occurs whenever a user accesses an affected page, making it crucial for site administrators to disable the Free Listing Submission feature, which is enabled by default during the plugin's setup.

References