Motors WordPress Plugin CVE-2026-91022

Exploitation requires an authenticated user who has been assigned a custom listing-management role by an administrator, and who can edit a listing's 'badge' setting; the plugin fails to sanitize/escape that value before writing it into an HTML attribute. The stored payload only fires when a listing is subsequently rendered and viewed by any visitor (UI:R), so a victim must load the affected listing page. Limiting factors: the attacker cannot self-provision the role (it must be granted by an admin), the site must actually use these delegated listing-management roles, and the affected version must be below 1.4.124; this confines realistic abuse to insider/compromised-contributor scenarios rather than anonymous internet exploitation.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Motors WordPress plugin, rated CVSS 6.8 (medium). The provided vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H indicates network reach with low complexity but requires privileges (PR:H) and victim interaction (UI:R). No EPSS score, KEV listing, or public exploit was provided, so exploitation is not demonstrated - no public exploit identified at time of analysis. The primary mitigating signal is the privilege requirement: exploitation depends on an attacker already holding a custom, administrator-assigned listing-management role, meaning this is a privilege-escalation/insider-abuse vector rather than a remote-unauthenticated mass-exploitation risk. CONFLICT TO VERIFY: the input vector sets C:H/I:H/A:H with S:U, which is unusually high for a stored XSS payload that executes in a viewer's browser; typical WordPress XSS of this shape carries limited (Low) impact with a scope change (S:C) because the script runs in another user's security context. Treat the 6.8 as a vendor/aggregator figure and prioritize this as a medium, conditions-gated issue rather than a drop-everything critical.

An attacker who has been granted a custom listing-management role by a site administrator edits a vehicle listing and injects a malicious script into the badge setting, which is written into an HTML attribute without sanitization or escaping. When any visitor - including an administrator - later views that listing, the stored script executes in their browser, enabling session hijacking or actions performed as the viewing admin. No public proof-of-concept was provided in the input.