384 matches found
CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...
EUVD-2026-81357
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...
CVE-2026-91016
The Motors WordPress plugin, in versions prior to 1.4.121 , fails to verify authorization before returning a user's non-published listings. An unauthenticated attacker can read any author's draft, pending, and private car listings—including titles, prices, media URLs, and seller notes—simply by s...
Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export
includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...
CVE-2025-4322
🔐 CVE-2025-4322 – Motors = 5.6.67 - 認証なしの権限昇格（パスワード更新/アカウント乗っ取り） 📌 テーマ情報 プラグイン : Motors = 5.6.67 - 認証なしの権限昇格（パスワード更新/アカウント乗っ取り） 脆弱性のあるバージョン : = 5.6.67 CVE : CVE-2025-4322 重大度 : 9.8 緊急 CWE ID : CWE-620 CWE名 : 未確認のパスワード変更 パッチ適用済み : ✅ はい パッチ優先度 : 🔴 緊急 公開日 : 2025年5月19日 研究者 :...
Blackash-CVE-2025-4322
CVE-2025-4322 : 認証されていないパスワード更新による権限昇格「アカウント乗っ取り 🔥」 説明 : Motors WordPressテーマは、バージョン5.6.67まで（同バージョンを含む）のすべてのバージョンにおいて、アカウント乗っ取りによる権限昇格の脆弱性があります。これは、テーマがパスワード更新前にユーザーの身元を適切に検証しないことに起因します。このため、認証されていない攻撃者が、管理者を含む任意のユーザーのパスワードを変更し、それを利用してアカウントにアクセスすることが可能になります。 メトリクス : CNA: Wordfence 基本スコア: 9.8 ⚫...
CVE-2025-2807
CVE-2025-2807：Motors 插件 漏洞利用者： Nxploited | Khaled Alenazi ⚠️ 漏洞概要 插件： Motors 📅 预计会因其简单性和严重影响而被大规模利用。 🚫 技术细节 漏洞端点：/wp-admin/admin-ajax.php 漏洞动作：mvlsetupwizardinstallplugin 所需访问级别：订阅者+ （已登录用户） 核心问题：缺少 currentusercan'installplugins' 或类似的能力检查 🚀 利用脚本（Python） 该脚本： 1. 以订阅者身份登录 2. 提取所需的 nonce（从 HTML 或...
CVE-2026-66693
Subscriber Broken Access Control in Motors = 1.4.113 versions...
EUVD-2026-57903
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66693
Affected component: WordPress Motors plugin (versions
CVE-2026-66693
Subscriber Broken Access Control in Motors = 1.4.113 versions...
WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mohamed Bassia in WordPress Plugin Motors versions = 1.4.113...
CVE-2026-13114
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-13114 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-13114
CVE-2026-13114 affects the Motors – Car Dealership & Classified Listings Plugin for WordPress, vulnerable to an unauthenticated Stored Cross-Site Scripting (XSS) via Comment Content and User Biographical Info in all versions up to 1.4.112. The flaw arises from insufficient input sanitization and ...
PT-2026-57376
Name of the Vulnerable Software and Affected Versions Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.113 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs when arbitra...