CVE-2026-96563: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in stylemix Motors – Car Dealership & Classified Listings Plugin

CVE-2026-96563 is a stored cross-site scripting vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. It affects all versions up to and including 1.4.123. The flaw exists due to improper neutralization of input in the 'stm_f_s' parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who visit the injected pages. The AJAX handler 'stm_ajax_add_a_car' exposes a nonce in the page footer, removing practical barriers to exploitation at low privilege levels.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the victim's privileges. The vulnerability does not allow unauthenticated exploitation but lowers the barrier for authenticated attackers due to nonce exposure.

No official patch or fix is currently documented. Users should monitor the vendor’s advisory for updates. Until a fix is available, restrict subscriber-level user capabilities if possible and avoid granting unnecessary access. Consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'stm_f_s' parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.