Kamil B

**Name of the Vulnerable Software and Affected Versions** Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.124 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `stm f s` parameter. Attackers can inject arbitrary web scripts into pages that execute when accessed by other users. The `stm ajax add a car` AJAX handler requires a nonce (a unique token used to prevent replay attacks), which is emitted in the wp footer on every page, allowing any authenticated user to obtain it. **Recommendations** Update the plugin to a version later than 1.4.123. Avoid using the `stm f s` parameter in the affected plugin until the update is applied.