CVE-2026-13114 is a stored cross-site scripting vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. It affects all versions up to and including 1.4.112. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of comment content and user biographical info. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no impact on availability. The vulnerability affects all users who view injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting use of the affected plugin. Implementing web application firewalls or input filtering may help mitigate risk but are not full replacements for a patch.