Description
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Motors | < 1.4.124 | 1.4.124 |
References
- https://wpscan.com/vulnerability/72672806-e2f3-417e-83c0-854c604028e4/ exploit vdb-entry technical-description