Motors – Car Dealership & Classified Listings Plugin vulnerabilities

Product

Motors – Car Dealership & Classified Listings Plugin

by stylemix · last CVE Oct 10, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Severity mix

Critical 0High 5Medium 9Low 0

Severity

Exploitation

Watch

Add Motors – Car Dealership & Classified Listings Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-2807	8.8	1%	Apr 8	Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation Affected: through 1.4.64
CVE-2026-3892	8.1	0%	May 14	Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Affected: through 1.4.107
CVE-2025-10494	8.1	1%	Oct 8	Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion Affected: through 1.4.89
CVE-2026-6806	7.5	0%	Sep 30	Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters Affected: through 1.4.109
CVE-2026-13114	7.2	0%	Jul 11	Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info Affected: through 1.4.112