Motors (WordPress) CVE-2026-13114

Exploitation requires the ability to submit content into the plugin's Comment Content field or the WordPress User Biographical Info field on a site running Motors <= 1.4.112; per CVSS PR:N this injection can be performed by unauthenticated attackers, so no login is needed for the initial payload. For impact to occur, a victim must subsequently load the page containing the stored payload - the high-value outcome (session/admin compromise) depends on an authenticated administrator or moderator viewing the injected content. Limiting factors: sites that disable comments or enforce pre-publication comment moderation break the primary injection/delivery path, the payload only fires when the affected page is rendered, and impact is bounded to browser-context actions (C:L/I:L, no direct availability impact).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N describes network-reachable, low-complexity, unauthenticated exploitation with a scope change and low confidentiality/integrity impact - consistent with a classic stored XSS reported by a credible source (Wordfence). No EPSS score, KEV entry, or public POC was provided, so real-world exploitation pressure appears lower than the 7.2 base score alone might suggest; there is no public exploit identified at time of analysis and it is not confirmed as actively exploited. The most significant risk is that the injection is unauthenticated and stored, so a single crafted comment or profile bio can compromise sessions of authenticated administrators (session theft, forged admin actions), which is the realistic path toward site takeover for stored XSS. Note a common convention conflict: stored XSS typically requires a victim to view the page, yet the vector lists UI:N - treat this as reflecting the injecting attacker's lack of interaction rather than the victim's, and prioritize based on the unauthenticated write primitive rather than the exact numeric score.

An unauthenticated attacker submits a listing/blog comment or edits a user biographical info field containing a crafted script payload (for example an event handler or <script> tag). The payload is stored and served to everyone who views the affected page, and when a logged-in administrator opens it the script executes in their session - enabling cookie/session theft or forged administrative actions. No public POC is referenced, but the network attack vector and low complexity make weaponization straightforward for anyone able to reach the comment or profile endpoints.