Stylemix Motors – Car Dealership & Classified Listings Plugin

• CVE-2026-104746 High 8.1 Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta –
• CVE-2026-116562 Medium 6.4 Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter –
• CVE-2026-116617 High 8.1 Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter 0.5%
• CVE-2026-96563 Medium 6.4 Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter 0.2%
• CVE-2026-6806 High 7.5 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters 0.3%
• CVE-2026-16750 Medium 5.3 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure 0.3%
• CVE-2026-13114 High 7.2 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info 0.4%
• CVE-2026-12435 Medium 4.3 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter 0.4%
• CVE-2026-3892 High 8.1 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter 0.3%
• CVE-2026-1934 Medium 4.3 Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter 0.2%
• CVE-2025-10494 High 8.1 Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion 0.5%
• CVE-2025-3437 Medium 4.3 Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up 0.3%
• CVE-2025-2808 Medium 5.4 Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.2%
• CVE-2025-2807 High 8.8 Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation 0.9%
• CVE-2024-13737 Medium 4.3 Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation 0.3%
• CVE-2024-10970 Medium 5.4 Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title 0.3%
• CVE-2024-5545 Medium 5.3 Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization 0.3%