Threats tagged 'ghsa-hmfh-3wmh-9pvf'

The Motors – Car Dealership & Classified Listings Plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'stm_f_s[make]' parameter. This affects all versions up to and including 1.4.128. The flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the Free Listing Submission feature to be enabled, which is on by default in the demo setup wizard configuration.