Unknown Motors vulnerabilities

4 CVEs affecting Unknown Motors, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-91023, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-91016, published 2026-09-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any…
CVE-2026-91022, published 2026-10-02. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned…
CVE-2026-7859, published 2026-06-22. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such…
CVE-2026-91023, published 2026-10-02. Low severity, CVSS 3.1. EPSS: 0.1% chance of exploitation in the next 30 days. The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated…