CVE-2026-28160: WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need an account or prior privileges to submit the malicious input.

Q: What versions are affected?

VikRentCar versions through 1.4.10 are affected. The earliest affected version is not specified.

Q: What is the likely impact if exploitation succeeds?

This is a stored XSS issue, meaning attacker-supplied script can be retained and later executed when a victim views the affected web content. The supplied vector indicates potential confidentiality, integrity, and availability impact, with scope changed.

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.

Other sources

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.

— NVD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade e4jvikwp VikRentCar vikrentcar to a version that resolves this vulnerability.
Fixed in 1.4.11

Event History

Oct 30, 2026

CVE Published

via MITRE·06:30 PM

Data Sourced

via MITRE·06:30 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need an account or prior privileges to submit the malicious input.

What versions are affected?

VikRentCar versions through 1.4.10 are affected. The earliest affected version is not specified.

What is the likely impact if exploitation succeeds?

This is a stored XSS issue, meaning attacker-supplied script can be retained and later executed when a victim views the affected web content. The supplied vector indicates potential confidentiality, integrity, and availability impact, with scope changed.

CVE-2026-28160: WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

Other sources

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What is the likely impact if exploitation succeeds?