What is the CVSS score of EUVD-2026-43130?

EUVD-2026-43130 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Motors (WordPress) are affected by EUVD-2026-43130?

The StyleMix Motors WordPress plugin (all versions through 1.4.112) contains a stored cross-site scripting vulnerability permitting unauthenticated attackers to inject malicious code through comment…

How to fix or mitigate EUVD-2026-43130?

Within 24 hours: Inventory all WordPress deployments using StyleMix Motors plugin and disable it immediately to prevent further injection. Within 7 days: Review web server logs for suspicious submissions in comment and biographical fields; deploy Web Application Firewall rules to block script injection patterns in user input. Within 30 days: Monitor vendor security advisories for patch release (expected version 1.4.113 or higher); deploy patch to all instances after staging validation.

Motors (WordPress) EUVD-2026-43130

| CVE-2026-13114 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-3gm5-qvcv-5943

WordPress XSS Wordpress Plugin Motors Car Dealership Classified Listings Plugin Stylemix

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/AC:L/PR:N), but a victim must view the stored payload so UI:R; script runs in a different context (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:46 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

HIGH 7.2

DescriptionCVE.org

The Motors - Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Stored cross-site scripting in the StyleMix Motors - Car Dealership & Classified Listings plugin for WordPress (all versions through 1.4.112) lets unauthenticated attackers persist malicious JavaScript through the Comment Content and User Biographical Info fields, which then executes in the browser of any visitor or administrator who views the affected page. The scope-changed CVSS 3.1 score of 7.2 reflects that injected script runs in a security context different from the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated injection path makes it broadly abusable against sites running this popular automotive/classifieds plugin.

Technical ContextAI

The affected component is a commercial WordPress plugin (cpe:2.3:a:stylemix:motors_-_car_dealership_&_classified_listings_plugin) that adds car-dealership and classified-listing functionality to WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-supplied data submitted via comment content and the user biographical info profile field is stored without sufficient sanitization and later rendered without adequate output escaping, so raw HTML/JavaScript is emitted into the page DOM. Referenced source files (includes/helpers.php line 278 and the listing-manager tooltip.js at lines 59/73) point to the code paths where untrusted values are handled and echoed, and the WordPress plugin repository changeset 3594971 represents the code change that remediates the flaw.

RemediationAI

Upstream fix available (WordPress.org changeset 3594971); the released patched version number is not independently confirmed from the provided data, so update the Motors plugin to the latest available release above 1.4.112 published by StyleMix and verify the installed version afterward. Confirm the fix details via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e25aa6-8028-4c85-98c4-6f47a1502427?source=cve) and the changeset (https://plugins.trac.wordpress.org/changeset/3594971/motors-car-dealership-classified-listings). Until patched, apply compensating controls: enable a WAF rule (e.g. Wordfence) to filter script payloads in comment and profile fields; require pre-publication moderation/approval of all comments so injected content never auto-renders (trade-off: manual review overhead); disable comments on affected listing pages if the feature is not essential (trade-off: loss of user engagement) and restrict who can set biographical info; and audit existing comments and user bios for already-stored script content, since patching stops new injections but does not remove payloads persisted before the upgrade.