CVE-2026-112835: WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress VikRentCarto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Which deployments should be considered potentially affected?
Installations using the e4jvikwp VikRentCar plugin at version 1.4.8 or earlier should be considered potentially affected. The available data does not identify a lower unaffected version boundary.
What does an attacker need to exploit this issue?
The attack can be delivered over the network and does not require attacker privileges or a low-complexity precondition. A user must interact with attacker-controlled content or a crafted request for exploitation to occur.
What is the potential security impact if exploitation succeeds?
The supplied severity vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed. This means the effects may extend beyond the vulnerable plugin's own security authority.