CVE-2025-32170: Motors Plugin Stored XSS Vulnerability

CVE-2025-32170 Overview

CVE-2025-32170 is a stored cross-site scripting (XSS) vulnerability in the Stylemix Motors WordPress plugin (motors-car-dealership-classified-listings). The flaw affects all plugin versions up to and including 1.4.71. The vulnerability stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in victim browsers when the affected pages are rendered.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads that execute in administrator or visitor browsers, enabling session theft, UI defacement, and redirection to attacker-controlled infrastructure.

Affected Products

• Stylemix Motors plugin (motors-car-dealership-classified-listings) versions through 1.4.71
• WordPress sites using the Motors car dealership and classified listings plugin
• Any dealership or listing page rendering unsanitized plugin-stored content

Discovery Timeline

• 2025-04-04 - CVE-2025-32170 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32170

Vulnerability Analysis

The Motors plugin fails to sanitize or encode user-controlled input before storing it and rendering it back inside HTML output. An authenticated user submits crafted input containing JavaScript, and the payload is persisted in the database. When a victim loads the affected page, the browser executes the stored script in the context of the WordPress site origin.

Stored XSS in a dealership plugin exposes both front-end visitors browsing listings and back-end administrators reviewing submissions. The scope change in the vulnerability indicates the injected content can affect resources beyond the vulnerable component, such as the WordPress admin interface. Successful exploitation requires victim interaction, typically viewing a listing or admin page.

Root Cause

The root cause is missing output encoding and insufficient input validation on fields handled by the plugin. Input that should be treated as untrusted text is rendered as HTML, allowing <script> tags and event handler attributes to execute. This is a classic violation of the OWASP output encoding guidance for user-controlled fields rendered in HTML context.

Attack Vector

Exploitation requires network access to the WordPress site and valid low-privileged credentials, such as a contributor or subscriber account depending on plugin configuration. The attacker submits a listing or form field containing a script payload. When an administrator or site visitor views the resulting page, the payload executes with access to cookies, DOM content, and any authenticated session held by the browser.

See the PatchStack advisory for CVE-2025-32170 for additional technical context.

Detection Methods for CVE-2025-32170

Indicators of Compromise

• Listing records or plugin metadata containing <script>, javascript:, or inline event handlers such as onerror= and onload=.
• Unexpected outbound requests from administrator browsers to unfamiliar domains after viewing plugin-managed pages.
• New or modified WordPress administrator accounts created shortly after an admin reviewed listing content.
• Session cookies for wp-admin observed in web proxy logs being transmitted to third-party hosts.

Detection Strategies

• Scan the WordPress database tables used by the plugin for HTML tags and script fragments in text fields.
• Review web server access logs for POST requests to plugin endpoints submitting fields with HTML entity patterns or encoded script content.
• Deploy a web application firewall (WAF) rule set that flags XSS payload patterns targeting plugin submission URLs.

Monitoring Recommendations

• Monitor WordPress audit logs for content submissions by low-privileged users followed by administrator page views.
• Alert on Content Security Policy (CSP) violation reports originating from pages served by the Motors plugin.
• Track plugin version inventory across managed WordPress sites and flag any instance at or below 1.4.71.

How to Mitigate CVE-2025-32170

Immediate Actions Required

• Update the Motors plugin to a version later than 1.4.71 as soon as the vendor publishes a fixed release.
• Audit existing listings and plugin-managed content for stored script payloads and remove malicious entries.
• Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected.
• Restrict account registration and reduce the privileges of accounts that can submit listings until patched.

Patch Information

Refer to the PatchStack advisory and the Stylemix vendor changelog for the fixed version. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

• Deploy a WAF rule that blocks requests containing <script, javascript:, and common event-handler payloads against plugin endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
• Temporarily disable the Motors plugin on sites that cannot be patched immediately, especially those accepting public submissions.

# Example CSP header to limit inline script execution on affected pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"