Motors – Car Dealer, Classifieds & Listing, CVE-2026-91022
- CVE, Research URL
- Application
- Published on
- Oct 02, 2026
- Research Description
- The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
- Affected versions
-
max 1.4.124.
- Status
-
vulnerable