CVE-2026-13114

Name: CVE-2026-13114 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-13114

HIGH

CVSS v3.1: 7.2 · EPSS: 0.0023 (13.8 percentile)

NetworkNo privilegesNo user interactionXSSVendor advisory ref

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: HIGH
CVSS: 7.2 v3.1 · NVD
EPSS: 0.0023 (13.8 percentile) · FIRST.org
CISA KEV: No
Type: XSS · NVD CWE
Attack conditions (CVSS vector): NetworkNo privilegesNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 7.2 / 10 HIGH Source: NVD

EPSS 0.0023 13.8 percentile Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Record details

CVE ID: CVE-2026-13114
CVSS (v3.1): 7.2 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Exploitability subscore: 3.9
Impact subscore: 2.7
EPSS: 0.0023 (13.8 percentile) — 2026-07-12
CISA KEV: No
Weakness (CWE): CWE-79
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

← Back to all records

CVE-2026-13114

At a glance

CVSS / EPSS / KEV

Description

Record details

References

Related records

Same weakness type (CWE)

Published the same year