CVE-2026-91022: Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

Q: Which users can exploit this issue?

Exploitation requires a user who has the custom listing-management role assigned by an administrator. The attacker must be able to set a listing badge color value.

Q: Who can be affected when the payload executes?

Any visitor who views the affected listing can have the injected script execute in their browser. This includes administrators viewing the listing.

Q: Does exploitation require interaction from a victim?

Yes. A victim must view a listing containing the malicious badge color value for the script to execute.

Published Oct 2, 2026

Updated

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

Affected Software

1 affected component

Motors Motors WordPress plugin<1.4.124

Event History

Oct 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Exploitation requires a user who has the custom listing-management role assigned by an administrator. The attacker must be able to set a listing badge color value.

Who can be affected when the payload executes?

Any visitor who views the affected listing can have the injected script execute in their browser. This includes administrators viewing the listing.

Does exploitation require interaction from a victim?