WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

The primary impact of this Reflected XSS vulnerability is the potential for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be exploited to steal sensitive information such as session cookies, allowing the attacker to impersonate the user. Attackers could also redirect users to malicious websites, deface the website, or inject malware. The scope of the attack is limited to users who interact with the vulnerable page, but the potential for widespread impact exists if the plugin is widely deployed and user interaction is frequent. Successful exploitation requires an attacker to craft a malicious URL containing the XSS payload and entice a victim to click it.

Websites utilizing the ThemeMakers Car Dealer plugin, particularly those with user input fields that are not properly sanitized, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r '<script>' /var/www/html/wp-content/plugins/cardealer/*

• generic web:

curl -I https://example.com/vulnerable-page?param=<script>alert(1)</script>

• wordpress / composer / npm:

wp plugin list --status=inactive | grep cardealer

• wordpress / composer / npm:

wp plugin update cardealer

1. 2026-03-25Disclosure

   disclosure

1. Réservé2026-01-22
2. Publiée2026-03-25
3. Modifiée2026-04-28
4. EPSS mis à jour2026-04-02

The most effective mitigation for CVE-2026-24391 is to immediately upgrade the ThemeMakers Car Dealer plugin to version 1.6.8 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns indicative of XSS payloads, such as <script> tags or event handlers. Input validation and output encoding on the server-side can also help prevent XSS, but this is a more complex workaround. Regularly scan your WordPress installation for vulnerable plugins using a security scanner.