CVE-2026-112838: WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress VikRentCarto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack vector is network-based and requires no attacker privileges. Exploitation does require user interaction, meaning a victim must interact with attacker-influenced content.
Which installations should be considered affected?
VikRentCar versions through 1.4.8 are identified as affected. Organizations should inventory installed VikRentCar versions and treat deployments at or below 1.4.8 as potentially vulnerable.
What is the potential impact if exploitation succeeds?
The issue is a stored cross-site scripting vulnerability with low impacts to confidentiality, integrity, and availability. The vulnerability is rated high severity with a 7.1 score.