theme
16 known security issues reported for the Carspot WordPress theme. Most recent disclosed Jan 22, 2026.
Running Carspot on your site? Check whether your installed version is affected.
Scan your site free[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6.
The CarSpot theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfor...
[en] The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated a...
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attack...
The CarSpot – Dealership Wordpress Classified Theme for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.2.3 via the 'ad_id' parameter passed via the sb_remove_ad AJAX action. This makes it possible for unauthenticated attackers to delete any posting, page, or ad.
The CarSpot – Dealership Wordpress Classified Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘admin-ajax.php’ file in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scri...
Multiple Vulnerabilities (Authenticated Persistent XSS & IDOR) found by m0ze in WordPress CarSpot theme (versions <= 2.2.0).
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress CarSpot premium theme (versions <= 2.2.2).
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (ad post) vulnerability discovered by m0ze in WordPress CarSpot premium theme (versions <= 2.2.2).
Insecure Direct Object References (IDOR) vulnerability discovered by m0ze in WordPress CarSpot premium theme (versions <= 2.2.2).
The CarSpot – Dealership Wordpress Classified Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘admin-ajax.php’ file in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scri...
The CarSpot – Dealership Wordpress Classified Theme for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.2.3 via the 'ad_id' parameter passed via the sb_remove_ad AJAX action. This makes it possible for unauthenticated attackers to delete any posting, page, or ad.
[en] The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by QUIXSS in WordPress CarSpot theme (versions <= 2.1.6).
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS -> Registration Form/User Profile - Authenticated Persistent XSS -> Ad Post - IDOR leading to arbitrary deletion of ads Edit (WPSc...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free