What’s Vulnerable › Vulnerabilities

CVE-2025-14040: Automotive Car Dealership Business WordPress Theme <= 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-79

Description

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all versions up to, and including, 13.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'action_text', 'action_button_text', 'action_link', and 'action_class' custom fields. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

• themesuite Automotive Car Dealership Business WordPress Theme: through 13.4

References

• https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971
• https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971#item-description__changelog
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd4b65d-b916-432f-bb59-d2f8a9aadeac?source=cve

Get alerted when CVE-2025-14040 or the next vulnerability affects your stack