A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Motors – Car Dealer & Classified Ads Plugin. This vulnerability could allow a malicious actor to inject malicious scripts into your website, which could be executed when visitors visit your site.

This vulnerability was discovered and responsibly reported by Mika.

The vulnerability is an XSS vulnerability that occurs in the motors.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious scripts into the website.

Severity:

The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

Regrettably, as of the latest available information, there is no patched version available to remedy this XSS vulnerability within the Motors – Car Dealer & Classified Ads Plugin.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Inject malicious scripts into your website, which could allow them to:
    • Steal user information, such as cookies, session tokens, and passwords.
    • Redirect users to malicious websites.
    • Display malicious content on your website.
    • Take control of user accounts.

Recommendation:

Given the high-severity nature of this vulnerability, we strongly advise taking immediate action to safeguard the WordPress website:

  1. Mitigate the Risk: Until a patched version becomes available, it is wise to consider deactivating or uninstalling the Motors – Car Dealer & Classified Ads Plugin from the website. This proactive measure can help minimize the potential risk.
  2. Monitor for Updates: Continuously monitor for updates to the plugin. Check with the plugin developer for any news regarding the release of a patched version.
  3. Enhance Security Measures: Implement additional security measures such as web application firewalls (WAFs) and regular security audits to fortify the website’s defenses.

Conclusion:

Users of the Motors – Car Dealer & Classified Ads Plugin are strongly advised to uninstall the plugin and find an alternative solution. There is no patched version available, and the vendor has not responded to reports of the vulnerability.