CVE-2025-14040

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all versions up to, and including, 13.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'action_text', 'action_button_text', 'action_link', and 'action_class' custom fields. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971
• https://themeforest.net/item/automotive-car-dealership-business-wordpress-theme/9210971#item-description__changelog
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd4b65d-b916-432f-bb59-d2f8a9aadeac?source=cve

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14034The ilGhera Support System for WooCommerce plugin for WordPr…5.3
• CVE-2025-14035The DebateMaster plugin for WordPress is vulnerable to Store…4.4
• CVE-2025-14037The Invelity Product Feeds plugin for WordPress is vulnerabl…8.1
• CVE-2025-14038EDB Hybrid Manager contains a flaw that allows an unauthenti…7
• CVE-2025-14039The Simple Folio plugin for WordPress is vulnerable to Store…6.4
• CVE-2025-1404The Secure Copy Content Protection and Content Locking plugi…5.3
• CVE-2025-14042The Automotive Car Dealership Business WordPress Theme for W…6.4
• CVE-2025-14043The Tainacan plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2025-14044The Visitor Logic Lite plugin for WordPress is vulnerable to…8.1
• CVE-2025-14045The URL Media Uploader plugin for WordPress is vulnerable to…4.3
• CVE-2025-14046An improper neutralization of input vulnerability was identi…6.1
• CVE-2025-14047The Registration, User Profile, Membership, Content Restrict…5.3