Automotive Listings <= 18.6 - Reflected Cross-Site Scripting

2026-06-29 00:00

João Pedro S Alcântara (Kinorth)

Strategic Overview

Status

Unpatched

Affected PluginAutomotive Listings

Affected Version<= 18.6

CVSS6.1Medium

CVECVE-2026-27425

View all Automotive Listings vulnerabilities

Vulnerability Overview

The Automotive Listings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 18.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Technical Analysis

REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

External References

https://www.cve.org/CVERecord?id=CVE-2026-27425 https://www.wordfence.com/threat-intel/vulnerabilities/id/189c2409-5111-489c-bd91-86f6a6a6cdcb

Automotive Listings <= 18.6 - Reflected Cross-Site Scripting (CVE-2026-27425)