Motors – Car Dealership & Classified Listings Plugin
12 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Motors – Car Dealership & Classified Listings Plugin, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Motors – Car Dealership & Classified Listings Plugin CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 3 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 1 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 2 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 1 |
Severity
How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High4
- Medium8
Latest CVEs
The 12 most recently published vulnerabilities affecting Motors – Car Dealership & Classified Listings Plugin.
- CVE-2026-16750Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure5.3
- CVE-2026-13114Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info7.2
- CVE-2026-12435Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter4.3
- CVE-2026-3892Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter8.1
- CVE-2026-1934Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter4.3
- CVE-2025-10494Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion8.1
- CVE-2025-3437Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up4.3
- CVE-2025-2808Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting5.4
- CVE-2025-2807Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation8.8
- CVE-2024-13737Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation4.3
- CVE-2024-10970Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title5.4
- CVE-2024-5545Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization5.3
Product grouping is registry-driven, with AI assist and human review. How it works