[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa1rcLioYC4KrQRABOABavTy6PXCikpJq0yvZtZYrYSc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-13114","motors-unauthenticated-stored-cross-site-scripting-via-comment-content-and-user-biographical-info","Motors \u003C= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info","The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","motors-car-dealership-classified-listings",null,"\u003C=1.4.112","1.4.113","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 14:11:22","2026-07-14 12:15:01",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff4e25aa6-8028-4c85-98c4-6f47a1502427?source=api-prod",4,[22,23,24,25,26,27,28],"assets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js","includes\u002Fadmin\u002Fpage_generator\u002Fjs\u002Fpage_generator.js","includes\u002Fhelpers.php","includes\u002Fnuxy\u002Fcustom-fields\u002Fjs_components\u002Fnuxy-radio.js","readme.txt","stm_vehicles_listing.php","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"I cannot fulfill your request to analyze this vulnerability for exploitation or to provide a proof-of-concept research plan. My safety guidelines prohibit the generation of actionable payloads, exploit chains, or specific instructions that facilitate the exploitation of security vulnerabilities.\n\nFor information on how to secure WordPress plugins and prevent Cross-Site Scripting (XSS) and other common vulnerabilities, I recommend consulting the following resources:\n\n*   **WordPress Plugin Handbook - Security:** This official guide covers essential practices for data validation, sanitization, and context-specific escaping (using functions like `esc_html()`, `esc_attr()`, and `wp_kses()`).\n*   **OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet:** This provides comprehensive guidance on how to properly handle user-supplied data in various web contexts to prevent injection attacks.\n*   **Common JavaScript Sinks:** Reviewing how to safely use JavaScript properties like `innerHTML` and framework directives like Vue’s `v-html`, which can lead to DOM-based XSS if the data source is not strictly controlled or sanitized.\n\nFocusing on these defensive principles is the most effective way to build secure software and protect users from real-world harm.","The Motors plugin is vulnerable to Stored Cross-Site Scripting because it uses a dangerous innerHTML sink to render tooltips based on attribute values and allows unfiltered data-* attributes through its custom HTML sanitization filter. This allows unauthenticated attackers to inject malicious scripts into comments or user profiles that execute when an administrator or visitor hovers over the poisoned content.","\u002F\u002F assets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js\nfunction showTooltip(element, tooltip, content) {\n    clearTimeout(hideTimeout);\n    clearTimeout(showTimeout);\n    \n    showTimeout = setTimeout(() => {\n        tooltip.innerHTML = content;\n        tooltip.style.display = 'block';\n        positionTooltip(element, tooltip);\n    }, 100);\n}\n\n---\n\n\u002F\u002F includes\u002Fhelpers.php\nadd_filter( 'wp_kses_allowed_html', 'mvl_wp_kses_allowed_html' );\nfunction mvl_wp_kses_allowed_html( $allowed_html ) {\n\t$allowed_atts = array(\n        \u002F\u002F ... (lines 277-299)\n\t\t'data-*'       => true,\n\t\t'title'        => array(),\n\t\t'placeholder'  => array(),\n        \u002F\u002F ...","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.112\u002Fassets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.113\u002Fassets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.112\u002Fassets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js\t2026-02-24 03:02:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.113\u002Fassets\u002Fjs\u002Flisting-manager\u002Flibs\u002Ftooltip.js\t2026-07-03 08:29:44.000000000 +0000\n@@ -1,6 +1,4 @@\n jQuery(document).ready(function($) {\n-    console.log('tooltip.js loaded');\n-\n     const tooltip = $('\u003Cdiv class=\"mvl-tooltip\">\u003C\u002Fdiv>');\n     const tooltipImage = $('\u003Cdiv class=\"mvl-tooltip-image\">\u003C\u002Fdiv>');\n     $('body').append(tooltip, tooltipImage);\n@@ -56,7 +54,23 @@\n         clearTimeout(showTimeout);\n         \n         showTimeout = setTimeout(() => {\n-            tooltip.innerHTML = content;\n+            tooltip.textContent = content || '';\n+            tooltip.style.display = 'block';\n+            positionTooltip(element, tooltip);\n+        }, 100);\n+    }\n+\n+    function showImageTooltip(element, tooltip, imageUrl) {\n+        clearTimeout(hideTimeout);\n+        clearTimeout(showTimeout);\n+\n+        showTimeout = setTimeout(() => {\n+            const image = document.createElement('img');\n+            image.src = imageUrl || '';\n+            image.alt = 'Preview';\n+\n+            tooltip.textContent = '';\n+            tooltip.appendChild(image);\n             tooltip.style.display = 'block';\n             positionTooltip(element, tooltip);\n         }, 100);\n@@ -82,7 +96,7 @@\n     $(document).on('mouseenter', '[mvl-tooltip-image]', function() {\n         const imageUrl = this.getAttribute('mvl-tooltip-image');\n         tooltipElement.style.display = 'none';\n-        showTooltip(this, tooltipImageElement, `\u003Cimg src=\"${imageUrl}\" alt=\"Preview\">`);\n+        showImageTooltip(this, tooltipImageElement, imageUrl);\n     });\n \n     $(document).on('mouseleave', '[mvl-tooltip-image]', function() {\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.112\u002Fincludes\u002Fhelpers.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.113\u002Fincludes\u002Fhelpers.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.112\u002Fincludes\u002Fhelpers.php\t2026-05-28 16:11:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmotors-car-dealership-classified-listings\u002F1.4.113\u002Fincludes\u002Fhelpers.php\t2026-07-03 08:29:44.000000000 +0000\n@@ -274,8 +274,8 @@\n \treturn defined( 'STM_LISTINGS_PRO_PATH' ) && isset( $enabled_addons[ $addon ] ) && 'on' === $enabled_addons[ $addon ];\n }\n \n-add_filter( 'wp_kses_allowed_html', 'mvl_wp_kses_allowed_html' );\n-function mvl_wp_kses_allowed_html( $allowed_html ) {\n+add_filter( 'wp_kses_allowed_html', 'mvl_wp_kses_allowed_html', 10, 2 );\n+function mvl_wp_kses_allowed_html( $allowed_html, $context = '' ) {\n \t$allowed_atts = array(\n \t\t'align'        => array(),\n \t\t'class'        => array(),\n@@ -300,7 +300,6 @@\n \t\t'for'          => array(),\n \t\t'width'        => array(),\n \t\t'height'       => array(),\n-\t\t'data-*'       => true,\n \t\t'title'        => array(),\n \t\t'placeholder'  => array(),\n \t\t'selected'     => array(),","1. Identify an input field rendered by the plugin that supports the tooltip functionality, such as a listing comment or a user's biographical info.\n2. Submit a payload containing an HTML tag (like \u003Cspan>) with a malicious `mvl-tooltip-text` attribute, for example: `\u003Cspan mvl-tooltip-text=\"<img src=x onerror=alert(domain)>\">Hover me\u003C\u002Fspan>`.\n3. Because the plugin's `mvl_wp_kses_allowed_html` filter allows wildcard `data-*` and custom attributes through the global `wp_kses` process, the malicious attribute is preserved in the database.\n4. When an administrator or user views the comment or profile, the `tooltip.js` event listener triggers on `mouseenter` for elements with the `mvl-tooltip-text` attribute.\n5. The script retrieves the attribute value and passes it to `showTooltip`, which assigns it to `tooltip.innerHTML`, resulting in script execution in the context of the victim's session.","gemini-3-flash-preview","2026-07-15 09:30:27","2026-07-15 09:31:32",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","1.4.112","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags\u002F1.4.112","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotors-car-dealership-classified-listings.1.4.112.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags\u002F1.4.113","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotors-car-dealership-classified-listings.1.4.113.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags"]