The Motors WordPress plugin versions prior to 1.4.124 contain a CWE-79 Cross-Site Scripting vulnerability. The issue arises from improper sanitization and escaping of a listing badge setting before it is rendered inside an HTML attribute. Users with a custom listing-management role, which is assigned by an administrator, can exploit this to inject malicious scripts. These scripts execute in the context of any visitor viewing the listing, potentially including administrators, leading to script execution in their browsers.

This vulnerability allows an attacker with a custom listing-management role to inject arbitrary scripts that execute in the browsers of visitors viewing the affected listing. This can lead to session hijacking, defacement, or other malicious actions executed in the context of the vulnerable site. The impact is limited to users who have the ability to manage listings and the visitors who view those listings, including administrators.

A fix is available in Motors plugin version 1.4.124. Users should upgrade to version 1.4.124 or later to remediate this vulnerability. Since no vendor advisory or patch link is provided, verify the availability of the update from the official plugin source before upgrading. Until patched, restrict the assignment of the custom listing-management role to trusted users only.