Motors – Car Dealership & Classified Listings Plugin vulnerabilities
7 known vulnerabilities in Motors – Car Dealership & Classified Listings Plugin from Stylemix. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Motors – Car Dealership & Classified Listings…: Improper Limitation of a Pathname to a Restricted Directory
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This
- 8.1 High severity
Motors – Car Dealership & Classified Listings…: Improper Limitation of a Pathname to a Restricted Directory
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, wri
- 7.5 High severity
Motors – Car Dealership & Classified Listings…: Improper Neutralization of Special Elements used in an SQL Command
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied pa
- 7.2 High severity
Motors – Car Dealership & Classified Listings…: Improper Neutralization of Input During Web Page Generation
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and o
- 8.1 High severity
Motors – Car Dealership & Classified Listings…: External Control of File Name or Path
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The pl
- 8.1 High severity
Motors – Car Dealership & Classified Listings…: External Control of File Name or Path
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible
- 8.8 High severity
Motors – Car Dealership & Classified Listings…: Missing Authorization
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This