CVE-2026-39790: WordPress VikRentCar plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Q: Does an attacker need a WordPress account to exploit this issue?

No. The vulnerability is identified as unauthenticated, and the CVSS vector lists no privileges required (PR:N).

Q: Does exploitation require someone to interact with attacker-controlled content?

Yes. The CVSS vector specifies user interaction is required (UI:R), so exploitation depends on a user taking an action such as viewing or following attacker-supplied content.

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed (S:C).

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.6 versions.

Affected Software

1 affected component

vikwp VikRentCar<=1.4.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need a WordPress account to exploit this issue?

No. The vulnerability is identified as unauthenticated, and the CVSS vector lists no privileges required (PR:N).

Does exploitation require someone to interact with attacker-controlled content?

Yes. The CVSS vector specifies user interaction is required (UI:R), so exploitation depends on a user taking an action such as viewing or following attacker-supplied content.

What is the expected security impact if exploitation succeeds?

The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed (S:C).

CVE-2026-39790: WordPress VikRentCar plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Does an attacker need a WordPress account to exploit this issue?

Does exploitation require someone to interact with attacker-controlled content?

What is the expected security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need a WordPress account to exploit this issue?

Does exploitation require someone to interact with attacker-controlled content?

What is the expected security impact if exploitation succeeds?