The Automotive Listings plugin for WordPress contains a reflected Cross‑Site Scripting vulnerability in all releases up to version 18.6. This flaw permits an attacker to inject arbitrary JavaScript that executes in the browser of any user who views a page generated by the plugin, without requiring authentication or modifying server data. The impact is strictly client‑side and does not involve privilege escalation or data exfiltration.

The vulnerability affects the Themesuite Automotive Listings plugin for WordPress, versions equal to or older than 18.6. While the CVE does not explicitly state that later releases are fixed, organizations should verify that their installed plugin version is not vulnerable. Any WordPress site running a vulnerable plugin instance is exposed.

The CVSS score of 7.1 indicates high severity, and the EPSS score of <1% reflects a low but non‑zero likelihood of exploitation. Because authentication is not required, any visitor to the plugin’s front‑end can supply a malicious payload. The most likely attack vector is a specially crafted URL or query string that triggers the vulnerable output. The vulnerability is not listed in the CISA KEV catalog.