CVE-2026-116562: Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter

Q: Who can exploit this issue?

An authenticated WordPress user with at least Subscriber-level access can exploit it. The attacker must be able to submit a value through the stm_f_s[make] parameter.

Q: Are default installations affected?

The vulnerable condition requires the Free Listing Submission feature to be enabled. This feature is enabled by default in the Setup Wizard demo configuration.

Q: What is required for the injected script to run?

A user must access a page containing the attacker-injected content. The stored script then executes in that user's browser.

Q: How can I determine whether my site is affected?

Sites using the Motors plugin at version 1.4.128 or earlier are affected if Free Listing Submission is enabled. Review whether users with Subscriber or higher roles can submit listing data using the affected make field.

Published Nov 7, 2026

Updated

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs[make]' parameter in all versions up to, and including, 1.4.128 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Free Listing Submission feature to be enabled, which is shipped on by default via the Setup Wizard demo configuration.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with at least Subscriber-level access can exploit it. The attacker must be able to submit a value through the stm_f_s[make] parameter.

Are default installations affected?

The vulnerable condition requires the Free Listing Submission feature to be enabled. This feature is enabled by default in the Setup Wizard demo configuration.

What is required for the injected script to run?

A user must access a page containing the attacker-injected content. The stored script then executes in that user's browser.

How can I determine whether my site is affected?

Sites using the Motors plugin at version 1.4.128 or earlier are affected if Free Listing Submission is enabled. Review whether users with Subscriber or higher roles can submit listing data using the affected make field.

CVE-2026-116562: Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What is required for the injected script to run?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What is required for the injected script to run?

How can I determine whether my site is affected?