The CarDealerPress plugin for WordPress suffers from a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping of the 'saleclass' parameter. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute when other users access the compromised pages. This vulnerability affects all versions up to and including 6.8.2505.00. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacting confidentiality and integrity with no impact on availability. No patch or remediation details are currently provided.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject and execute arbitrary scripts in the context of the affected site. This can lead to unauthorized actions, data theft, or session hijacking for users who visit the injected pages. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider monitoring or disabling the vulnerable plugin if feasible. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.