Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 34

Reset filters

Medium 09.10.2026

CVE-2026-96563

Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter

The Motors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the stm_f_s parameter. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts that execute when pages are viewed.

Medium 05.10.2026

CVE-2026-104399

Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure

Medium 30.09.2026

CVE-2026-91023

Motors – Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization

Medium 30.09.2026

CVE-2026-91022

Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting

High 29.09.2026

CVE-2026-6806

Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

Medium 17.09.2026

CVE-2026-16750

Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

Medium 15.09.2026

CVE-2026-91016

Motors <= 1.4.120 - Unauthenticated Insecure Direct Object Reference

Medium 10.08.2026

CVE-2026-66693

Motors – Car Dealership & Classified Listings Plugin <= 1.4.113 - Missing Authorization

High 10.07.2026

CVE-2026-13114

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info

Medium 30.06.2026

CVE-2026-12435

Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter

Medium 22.06.2026

CVE-2026-7859

Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery

Medium 17.06.2026

CVE-2026-54828

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization

High 17.06.2026

CVE-2026-54812

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection

High 17.06.2026

CVE-2026-54814

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion

High 13.05.2026

CVE-2026-3892

Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter

Medium 11.05.2026

CVE-2026-1934

Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter

Medium 21.04.2026

CVE-2026-39515

Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization

High 07.10.2025

CVE-2025-10494

Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion

Medium 30.07.2025

CVE-2025-54691

Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference

Critical 09.04.2025

CVE-2025-32654

Motors <= 1.4.71 - Unauthenticated Local File Inclusion

High 07.04.2025

CVE-2025-2807

Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

Medium 07.04.2025

CVE-2025-3437

Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up

Medium 07.04.2025

CVE-2025-2808

Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Medium 04.04.2025

CVE-2025-32170

Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting

Showing 1 to 24 of 34 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 34

Know which vulnerabilities affect your application

Application security in your inbox