The plugin accepts a Phone Number field that is not sanitized or escaped, allowing an authenticated Subscriber or higher to store arbitrary script code. After injection, the malicious code runs in the browser of any visitor who views the affected page, potentially leaking session cookies, defacing the site, or enabling further attacks.

WordPress plugin Motors – Car Dealership & Classified Listings by Stylemix Themes. Versions up to 1.4.63 (inclusive) are vulnerable.

With a CVSS score of 5.4 the flaw is considered moderate. The EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be logged in with Subscriber‑level or higher privileges and to create or modify a phone number record; subsequent victims only need to view the injected page.