The theme contains a stored XSS vulnerability in its Call to Action custom fields. Insufficient input sanitization and output escaping allow an attacker with contributor‑level or higher permissions to inject arbitrary JavaScript. The injected script executes for any user who views the affected page, potentially compromising accounts, defacing content, or stealing session cookies.

All installations of the Automotive Car Dealership Business WordPress Theme up to and including version 13.4 are affected. Only accounts with contributor or higher privileges can exploit the flaw.

The CVSS score of 6.4 indicates a medium severity risk, while the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but it remains a potential threat because the attacker requires only contributor access, a privilege granted to many users. Exploitation would involve a user‑initiated insert of malicious script into the custom fields, which will then be rendered unsafely on page load.