Plugin security history

Motors – Car Dealership & Classified Listings Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with Motors – Car Dealership & Classified Listings Plugin, published between 2019 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

26Total records

2Critical

8High

16Medium

0Low

0Informational

26Patched records

0Currently marked unpatched

2019-09-20First disclosure

2026-07-10Latest disclosure

26 of 26CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	2	2 records
2022	1	1 records
2023	3	3 records
2024	1	1 records
2025	10	10 records
2026	9	9 records

Severity Breakdown

Severity	Records	Share
Critical	2	7.7%
High	8	30.8%
Medium	16	61.5%

Vulnerability-Type Breakdown

Missing Authorization

9 records34.6%

First: 2024. Latest: 2026.

Other

6 records23.1%

First: 2019. Latest: 2026.

Cross-Site Scripting

5 records19.2%

First: 2019. Latest: 2026.

CSRF

2 records7.7%

First: 2023. Latest: 2026.

Path Traversal

2 records7.7%

First: 2025. Latest: 2026.

Arbitrary File Upload

1 record3.8%

First: 2022. Latest: 2022.

SQL Injection

1 record3.8%

First: 2026. Latest: 2026.

Patch Status

Patched: 26
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.4.113
1.4.112
1.4.110
1.4.108
1.4.104
1.4.107
1.4.90
1.4.81
1.4.72
1.4.65
1.4.67
1.4.64
1.4.58
1.4.44
1.4.11
1.4.7
1.4.6
1.4.4
1.4.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.4.112`	Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info	July 10, 2026	1.4.113	High
`*-1.4.111`	Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter	June 30, 2026	1.4.112	Medium
`[*, 1.4.110)`	Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery	June 22, 2026	1.4.110	Medium
`*-1.4.109`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization	June 17, 2026	1.4.110	Medium
`*-1.4.109`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection	June 17, 2026	1.4.110	High
`*-1.4.109`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion	June 17, 2026	1.4.110	High
`*-1.4.107`	Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter	May 13, 2026	1.4.108	High
`*-1.4.103`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter	May 11, 2026	1.4.104	Medium
`[*, 1.4.107)`	Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization	April 21, 2026	1.4.107	Medium
`*-1.4.89`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion	October 7, 2025	1.4.90	High
`*-1.4.80`	Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference	July 30, 2025	1.4.81	Medium
`*-1.4.71`	Motors <= 1.4.71 - Unauthenticated Local File Inclusion	April 9, 2025	1.4.72	Critical
`*-1.4.64`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	April 7, 2025	1.4.65	High
`*-1.4.66`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up	April 7, 2025	1.4.67	Medium
`*-1.4.63`	Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting	April 7, 2025	1.4.64	Medium
`*-1.4.71`	Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 4, 2025	1.4.72	Medium
`*-1.4.71`	Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion	April 4, 2025	1.4.72	High
`*-1.4.57`	Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation	March 21, 2025	1.4.58	Medium
`*-1.4.43`	Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title	January 15, 2025	1.4.44	Medium
`*-1.4.9`	Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization	July 1, 2024	1.4.11	Medium
`*-1.4.6`	Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery	October 19, 2023	1.4.7	High
`*-1.4.6`	Motors – Car Dealer & Classified Ads <= 1.4.6 - Reflected Cross-Site Scripting	October 19, 2023	1.4.7	Medium
`*-1.4.5`	Motors – Car Dealer & Classified Ads <= 1.4.5 - Cross-Site Request Forgery via Multiple Functions	April 19, 2023	1.4.6	Medium
`*-1.4.3`	Motors – Car Dealer, Classifieds & Listing <= 1.4.3 - Unauthenticated Arbitrary File Upload	November 21, 2022	1.4.4	Critical
`[*, 1.4.1)`	Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export	September 20, 2019	1.4.1	Medium

Selected source records

Latest Records

HighCVE-2026-13114

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info

Published: July 10, 2026

Affected versions: *-1.4.112
Patched versions: 1.4.113

Original Wordfence record

MediumCVE-2026-12435

Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter

Published: June 30, 2026

Affected versions: *-1.4.111
Patched versions: 1.4.112

Original Wordfence record

MediumCVE-2026-7859

Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery

Published: June 22, 2026

Affected versions: [*, 1.4.110)
Patched versions: 1.4.110

Original Wordfence record

HighCVE-2026-54814

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion

Published: June 17, 2026

Affected versions: *-1.4.109
Patched versions: 1.4.110

Original Wordfence record

HighCVE-2026-54812

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection

Published: June 17, 2026

Affected versions: *-1.4.109
Patched versions: 1.4.110

Original Wordfence record

MediumCVE-2026-54828

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization

Published: June 17, 2026

Affected versions: *-1.4.109
Patched versions: 1.4.110

Original Wordfence record

HighCVE-2026-3892

Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter

Published: May 13, 2026

Affected versions: *-1.4.107
Patched versions: 1.4.108

Original Wordfence record

MediumCVE-2026-1934

Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter

Published: May 11, 2026

Affected versions: *-1.4.103
Patched versions: 1.4.104

Original Wordfence record

Highest-Severity Records

CriticalCVE-2025-32654

Motors <= 1.4.71 - Unauthenticated Local File Inclusion

Published: April 9, 2025

Affected versions: *-1.4.71
Patched versions: 1.4.72

Original Wordfence record

CriticalCVE-2022-3989

Motors – Car Dealer, Classifieds & Listing <= 1.4.3 - Unauthenticated Arbitrary File Upload

Published: November 21, 2022

Affected versions: *-1.4.3
Patched versions: 1.4.4

Original Wordfence record

HighCVE-2025-32142

Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion

Published: April 4, 2025

Affected versions: *-1.4.71
Patched versions: 1.4.72

Original Wordfence record

HighCVE-2025-2807

Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

Published: April 7, 2025

Affected versions: *-1.4.64
Patched versions: 1.4.65

Original Wordfence record

HighCVE-2026-3892

Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter

Published: May 13, 2026

Affected versions: *-1.4.107
Patched versions: 1.4.108

Original Wordfence record

HighCVE-2025-10494

Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion

Published: October 7, 2025

Affected versions: *-1.4.89
Patched versions: 1.4.90

Original Wordfence record

HighCVE-2026-54814

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion

Published: June 17, 2026

Affected versions: *-1.4.109
Patched versions: 1.4.110

Original Wordfence record

HighCVE-2026-54812

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection

Published: June 17, 2026

Affected versions: *-1.4.109
Patched versions: 1.4.110

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory