Motors Car Dealership CVE-2026-96563

Requires an authenticated WordPress account at Subscriber level or above on a site running the Motors - Car Dealership & Classified Listings plugin (≤1.4.123). The attacker must send a crafted 'stm_f_s' parameter to the stm_ajax_add_a_car AJAX handler; the CSRF nonce normally protecting that handler is emitted in wp_footer on every page, so any logged-in user can read it, eliminating the usual nonce barrier. Exploitation is limited by the need for a valid account - significant only where user registration is open (common for classified/listing sites) - and the stored payload only fires when a user subsequently visits the injected page (UI:N for the attacker's injection step, but victim page-view is needed for impact).

This is a moderate-risk, authenticated stored XSS (CWE-79) in a WordPress plugin, scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) by Wordfence. The signals are internally consistent: network vector with low complexity, but privileges are required (PR:L = authenticated Subscriber), which caps severity below Critical. No EPSS score was provided in the input and the vulnerability is not listed in CISA KEV, so there is no public evidence of active exploitation. No proof-of-concept was supplied in the references either. The elevated concern relative to a typical Subscriber-level XSS comes from the description's note that the stm_ajax_add_a_car nonce is emitted in wp_footer on every page, making it trivially accessible to any authenticated user and removing the usual nonce barrier - this raises practical exploitability but does not change the fact that an account is still required. Net: a real but not top-tier priority. It matters most on sites that allow open user registration (common for classified/dealership listing sites), where obtaining Subscriber access is effortless; on sites with closed registration the practical risk is substantially lower. EPSS and KEV data are absent/negative, so prioritize patching behind any unauthenticated or admin-level flaw.

An attacker registers (or already holds) a Subscriber-level account on a Motors-powered WordPress site, retrieves the stm_ajax_add_a_car nonce exposed in the page footer, and submits a crafted 'stm_f_s' value containing a malicious script via the AJAX handler. The script is stored and later executes in the browser of any user - potentially an administrator - who views the affected page, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at time of analysis, and exploitation requires an authenticated session (PR:L).