What’s Vulnerable › Products
stylemix Motors – Car Dealership & Classified Listings Plugin vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your stylemix Motors – Car Dealership & Classified Listings Plugin version is affected
Latest stylemix Motors – Car Dealership & Classified Listings Plugin vulnerabilities
- CVE-2026-96563 — Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter (CVSS 6.4)
- CVE-2026-91023 — Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured (CVSS 3.1)
- CVE-2026-91022 — Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color (CVSS 6.8)
- CVE-2026-6806 — Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters (CVSS 7.5)
- CVE-2026-16750 — Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure (CVSS 5.3)
- CVE-2026-91016 — Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure (CVSS 5.3)
- CVE-2026-13114 — Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info (CVSS 7.2)
- CVE-2026-12435 — Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter (CVSS 4.3)
- CVE-2026-7859 — Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media (CVSS 5.3)
- CVE-2026-3892 — Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter (CVSS 8.1)
- CVE-2026-1934 — Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter (CVSS 4.3)
- CVE-2025-10494 — Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- CVE-2025-3437 — Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up (CVSS 4.3)
- CVE-2025-2808 — Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2025-2807 — Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8)
- CVE-2024-13737 — Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation (CVSS 4.3)
- CVE-2024-10970 — Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title (CVSS 5.4)
- CVE-2024-5545 — Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization (CVSS 5.3)
- CVE-2023-46207 — WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.5)
- CVE-2023-46208 — WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2022-38716 — WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2022-3989 — Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload (CVSS 8.8)
- CVE-2019-17229 — (CVSS 6.1)
- CVE-2019-17228 — (CVSS 6.5)