2898 matches found
CVE-2026-12435
The Motors – Car Dealership & Classified Listings Plugin for WordPress is affected up to version 1.4.111 by an authorization bypass. An authenticated user with subscriber-level access can mark or unmark another user’s car listing as Sold by replaying a valid nonce from their own listing against a...
EUVD-2026-40935
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-12435: Missing Authorization
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-54512
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Automotive Car Dealership Business versions = 13.3.3...
CVE-2026-12937: Improper Neutralization of Special Elements used in an SQL Command
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'postid' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficie...
WordPress Motors Car Dealership & Classified Listings plugin < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media vulnerability
Unauthenticated Post-Meta Write via stmajaxaddacarmedia vulnerability discovered by Mustafa Ahmed in WordPress Plugin Motors versions 1.4.110...
EUVD-2025-210206
Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...
EUVD-2025-210174
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69151
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69139
Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...
CVE-2025-69151: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69139: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...
CVE-2025-69151 WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69151 WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69151
CVE-2025-69151 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Grand Car Rental theme, affecting versions up to 3.7. The available description confirms the vulnerability class (XSS) and that exploitation does not require authentication, but the provided mate...
CVE-2025-69139
CVE-2025-69139 : WordPress Car Zone theme (
CVE-2025-69139 WordPress Car Zone theme <= 3.7 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...
