Stylemixthemes Motors Car Dealer Classifieds Listing vulnerabilities

CVE-2019-17228 [MEDIUM] CWE-345 CVE-2019-17228: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Cla includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.

CVE-2025-2807 [HIGH] CWE-862 CVE-2025-2807: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbit The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inst

CVE-2022-3989 [HIGH] CWE-434 CVE-2022-3989: The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous fil The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.

CVE-2023-46207 [HIGH] CWE-918 CVE-2023-46207: Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.

CVE-2022-38716 [HIGH] CWE-352 CVE-2022-38716: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.

CVE-2024-10970 [MEDIUM] CWE-94 CVE-2024-10970: The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary s The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, wi

CVE-2024-5545 [MEDIUM] CWE-862 CVE-2024-5545: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized mo The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.

CVE-2019-17229 [MEDIUM] CWE-79 CVE-2019-17229: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Cla includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.

CVE-2025-2808 [MEDIUM] CWE-79 CVE-2025-2808: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in all versions up to, and including, 1.4.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to

CVE-2024-13737 [MEDIUM] CWE-862 CVE-2024-13737: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized mo The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motors_create_template and motors_delete_template functions in all versions up to, and including, 1.4.57. This makes it possible for authenticated attackers, with Subscriber-level access and

CVE-2023-46208 [MEDIUM] CWE-79 CVE-2023-46208: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Cl Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions.

CVE-2025-3437 [MEDIUM] CWE-862 CVE-2025-3437: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unaut The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajax_actions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticated attackers, with Subscriber-level access and above, to