{"id":"CVE-2026-66675","kind":"vulnerability","aliases":["CVE-2026-66675"],"related":[],"title":"Motors car dealership plugin: stored XSS lets attackers inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Stored XSS.This issue affects Motors: from n/a through 1.4.128.","summary":"The Motors car dealership and classified listings WordPress plugin by StylemixThemes fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker can plant script that runs in the browser of other users who view the affected page, such as site visitors or administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motors-plugin","package","stylemixthemes","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `motors-car-dealership-classified-listings` plugin in the WordPress admin plugin list.\n- Look for the plugin's files under `wp-content/plugins/motors-car-dealership-classified-listings`.","fix":"- Motors (motors-car-dealership-classified-listings): versions through `1.4.128` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-09T10:17:10+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:20+00:00","updated_at":"2026-11-09T10:26:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- Motors (motors-car-dealership-classified-listings): versions through `1.4.128` are affected; the sources do not name a fixed version.","reach":"internet","title":"Motors car dealership plugin: stored XSS lets attackers inject scripts","impact":"medium","summary":"The Motors car dealership and classified listings WordPress plugin by StylemixThemes fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker can plant script that runs in the browser of other users who view the affected page, such as site visitors or administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","motors-plugin","stylemixthemes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in other users' browsers on the site","analyst_note":"Find the fixed version and whether unauthenticated users can inject the stored payload; check the vendor changelog and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-66675.","how_to_check":"- Check the installed version of the `motors-car-dealership-classified-listings` plugin in the WordPress admin plugin list.\n- Look for the plugin's files under `wp-content/plugins/motors-car-dealership-classified-listings`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Websites running the Motors car dealership and classified listings plugin for WordPress, up to and including version 1.4.128. Sites without this plugin are not affected. The sources do not say which configurations or user roles are required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000772,"input_tokens":4552,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-66675':13A,16A '1.4.128':103C 'administr':71B 'affect':64B,98C 'allow':94C 'attack':8A,49B 'browser':57B 'car':2A,25B,90C 'classifi':28B,92C 'cross':45B,81C 'cross-sit':44B,80C 'cve':11A,14A 'dealership':3A,26B,91C 'enabl':42B 'fail':34B 'generat':39B,79C 'improp':72C 'inject':9A 'input':37B,75C 'issu':97C 'let':7A 'list':29B,93C 'motor':1A,18B,24B,87C,89C,99C 'motors-car-dealership-classified-list':88C 'motors-plugin':17B 'n/a':101C 'neutral':36B,73C 'packag':20B 'page':41B,65B,78C 'plant':51B 'plugin':4A,19B,31B 'run':54B 'script':10A,47B,52B,83C 'site':46B,68B,82C 'store':5A,43B,95C 'stylemixthem':21B,33B,86C 'user':60B 'view':62B 'visitor':69B 'vulner':84C 'web':40B,77C 'wordpress':22B,30B 'xss':6A 'xss.this':96C","nicknames":[],"mitigations":[],"who_affected":"Websites running the Motors car dealership and classified listings plugin for WordPress, up to and including version 1.4.128. Sites without this plugin are not affected. The sources do not say which configurations or user roles are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","motorsplugin","package","stylemixthemes","wordpress"],"campaign_type":null,"search_a":"'-2026':12A,15A '-66675':13A,16A 'attack':8A 'car':2A 'cve':11A,14A 'dealership':3A 'inject':9A 'let':7A 'motor':1A 'plugin':4A 'script':10A 'store':5A 'xss':6A","search_b":"'administr':71B 'affect':64B 'attack':49B 'browser':57B 'car':25B 'classifi':28B 'cross':45B 'cross-sit':44B 'dealership':26B 'enabl':42B 'fail':34B 'generat':39B 'input':37B 'list':29B 'motor':18B,24B 'motors-plugin':17B 'neutral':36B 'packag':20B 'page':41B,65B 'plant':51B 'plugin':19B,31B 'run':54B 'script':47B,52B 'site':46B,68B 'store':43B 'stylemixthem':21B,33B 'user':60B 'view':62B 'visitor':69B 'web':40B 'wordpress':22B,30B","search_c":"'1.4.128':103C 'affect':98C 'allow':94C 'car':90C 'classifi':92C 'cross':81C 'cross-sit':80C 'dealership':91C 'generat':79C 'improp':72C 'input':75C 'issu':97C 'list':93C 'motor':87C,89C,99C 'motors-car-dealership-classified-list':88C 'n/a':101C 'neutral':73C 'page':78C 'script':83C 'site':82C 'store':95C 'stylemixthem':86C 'vulner':84C 'web':77C 'xss.this':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66675","severity":null,"published_at":"2026-11-09T10:17:10+00:00","modified_at":"2026-11-09T10:17:11+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}