CVE-2026-13114 is a stored cross-site scripting vulnerability (CWE-79) in the Motors – Car Dealership & Classified Listings Plugin for WordPress. It affects all versions up to and including 1.4.112. The vulnerability is due to improper neutralization of input during web page generation, specifically in comment content and user biographical information fields. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the affected pages. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity and no impact on availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the browsers of users who visit the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim user. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying temporary mitigations such as disabling comments or restricting user input fields if feasible. Monitor official vendor channels for updates and patches. Avoid relying on generic mitigations that do not specifically address this vulnerability.