CVE-2026-66675: WordPress Motors plugin <= 1.4.128 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Stored XSS.This issue affects Motors: from n/a through 1.4.128.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
motors-car-dealership-classified-listingsto a version that resolves this vulnerability.Fixed in 1.4.129
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The reported vector requires low-privileged access (PR:L) and user interaction (UI:R). The available data does not identify the specific WordPress role or interaction required.
What impact can successful exploitation have?
This is a stored XSS issue with low impacts to confidentiality, integrity, and availability. Its CVSS vector also indicates scope change (S:C), meaning impact may extend beyond the vulnerable component's original security authority.
Which plugin versions are affected?
Motors versions through 1.4.128 are affected. The affected version range begins at an unspecified version (n/a), so deployments of any known version at or below 1.4.128 should be treated as potentially affected.