Stored Cross-Site Scripting Vulnerability in Motors Plugin for WordPress

CVE-2026-96563

What is CVE-2026-96563?

The Motors – Car Dealership & Classified Listings Plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the 'stm_f_s' parameter. This issue arises from inadequate input validation and output escaping, enabling authenticated users with subscriber-level access or higher to inject malicious web scripts into web pages. These scripts will be executed whenever an affected page is accessed, potentially compromising the site's security. Furthermore, the nonce used by the 'stm_ajax_add_a_car' AJAX handler is rendered accessible on all pages, removing any significant barriers for exploitation at the Subscriber level.

References