CVE-2026-96563

Name of the Vulnerable Software and Affected Versions Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.124

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the stm f s parameter. Attackers can inject arbitrary web scripts into pages that execute when accessed by other users. The stm ajax add a car AJAX handler requires a nonce (a unique token used to prevent replay attacks), which is emitted in the wp footer on every page, allowing any authenticated user to obtain it.

Recommendations Update the plugin to a version later than 1.4.123. Avoid using the stm f s parameter in the affected plugin until the update is applied.