CarDealerPress
CarDealerPress has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for CarDealerPress has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. CarDealerPress is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-3860CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter
Read the full analysisVulnerability Records
CarDealerPress
Author
DealerTrend
Thank you for using CarDealerPress for your automotive site(s). CarDealerPress is a display plugin for the DealerTrend Vehicle Marketing System (VMS). This is a very active plugin and is used by large franchise auto groups as well as small independent dealerships across the U.S. and Canada. If you are a marketing company and would like to build car dealer websites with the CarDealerPress plugin we have a comprehensive reseller program. Please contact us via the CarDealerPress website for more information. The CarDealerPress plugin is GNU licensed however it does require a DealerTrend VMS subscription to be functional. CarDealerPress Terms of Service/Use
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C