The vulnerability is a stored Cross Site Scripting flaw arising from improper neutralization of user input during web page generation. The flaw allows an attacker to inject malicious scripts that are stored in the database and executed whenever a page that renders that data is viewed. This can lead to the theft of user credentials, session hijacking, or other client‑side attacks when site visitors load the affected content.

StylemixThemes Motors plugin versions up to 1.4.128 on any WordPress installation become vulnerable. The issue affects the plugin from the earliest version through 1.4.128, with no known work‐around except updating to the patched release.

The CVSS score of 6.5 indicates moderate severity, and the lack of an EPSS score and KEV listing mean no publicly known exploits are confirmed yet. The likely attack vector involves the plugin’s content entry interface, where an attacker who can inject input—either as a contributor or through a form that the plugin processes—stores malicious JavaScript. Once stored, any visitor to the rendered page will execute the code, potentially compromising the browser session of that visitor.