CVE-2026-13114

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 722 live websites that are affected by CVE-2026-13114.

Run a Free Instant Scan



Affected Software

Product  Motors Car Dealership Classified Listings
Category Wordpress Plugins
Vulnerable Domains722 live websites (100% of Motors Car Dealership Classified Listings install base)
Vulnerable Versions
  • from 0 through 1.4.112
Vulnerable Versions Count48 versions ( 98% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 11, 2026
  • Updated - Jul 13, 2026

Credits

  • Webbernaut (finder)

Website Distribution by Country

Number of websites using CVE-2026-13114
United States180 websites


Italy65 websites
Germany41 websites
Spain41 websites
GB33 websites
Netherlands30 websites
France30 websites
Canada27 websites
South Africa25 websites
Cyprus18 websites

Website Distribution by TLD

Number of websites using CVE-2026-13114
.com322 websites
.it42 websites
.nl26 websites
.co.uk25 websites
.es21 websites
.net17 websites
.com.br17 websites
.com.au16 websites
.de15 websites
.ca13 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13114

Top websites that are affected by CVE-2026-13114. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.fr France*,***,***
*************.org United States*,***,***
*************.***.au Australia*,***,***
****************.com United States*,***,***
***********************.***.au Australia*,***,***
****************.com Cyprus*,***,***
********************.com United States*,***,***
******.es Spain*,***,***
****************.com United States*,***,***
***********.fr France*,***,***
See full domain list

FAQ

CVE-2026-13114 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Motors Car Dealership Classified Listings
A total of 722 websites have been identified as vulnerable to CVE-2026-13114, based on global website indexing conducted by WebTechSurvey.
The Motors Car Dealership Classified Listings is affected by the CVE-2026-13114 vulnerability.
Motors Car Dealership Classified Listings versions up to and including 1.4.112 are vulnerable to CVE-2026-13114.

References