Auto Listings – Car Listings & Car Dealership Plugin for WordPress Security & Risk Analysis

The Auto-Listings plugin v2.7.3 presents a mixed security posture. While it demonstrates good practices in output escaping and avoids dangerous functions, its attack surface and vulnerability history raise concerns. The presence of two unprotected AJAX handlers represents a significant risk, as these can be leveraged by attackers to execute actions without proper authentication. The taint analysis, although not revealing critical or high severity flows, did identify one flow with an unsanitized path, which could potentially lead to vulnerabilities if not handled carefully. The plugin's vulnerability history, with two medium-severity CVEs, both related to Cross-Site Scripting, indicates a past pattern of input sanitization issues. The fact that the last vulnerability was recorded in late 2025 (though this date might be hypothetical for the purpose of this analysis) and is currently unpatched is a major concern, suggesting active exploitation or ongoing risks from known flaws.