EUVD-2026-108628
GHSA-p242-xw57-xmr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with script payload
-
DeliveryDeliver link to targeted user
-
ExploitVictim opens crafted link
-
ExecutionPayload reflected into page and executes in browser
-
ImpactSession hijack or actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to lure a user into opening a crafted link targeting the vulnerable VikRentCar endpoint (UI:R / reflected XSS), so it is not fully hands-off - success depends on victim interaction. The attacker needs no authentication (PR:N) and the site must be running VikRentCar at version 1.4.8 or earlier. The specific plugin parameter or endpoint that reflects unsanitized input is not described in the available sources. Being reflected rather than stored, the payload is not persisted and each victim must be individually enticed, which limits realistic impact. |
| Impact | This is a reflected cross-site scripting flaw (CWE-79) in the VikRentCar WordPress plugin (through 1.4.8), reported by Patchstack and assigned a 7.1 CVSS. The supplied vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated (PR:N) attack that nonetheless requires user interaction (UI:R) - characteristic of reflected XSS where a victim must open an attacker-crafted link, so it is not self-propagating or automatable. No EPSS score, SSVC automatable/technical-impact values, or KEV listing are present in the input; it is not on CISA KEV and no verified exploit code is referenced, so there is no confirmed active exploitation. The only priority signal is the vuln.today 'this_week' decision label, which aligns with a medium-urgency reflected XSS rather than an emergency. Net assessment: a genuine but interaction-dependent web vulnerability - real enough to patch promptly, but the reliance on tricking a user and the absence of exploitation/EPSS evidence place it below mass-exploited, unauthenticated-RCE-class issues. The reflected (not stored) nature further limits blast radius to individually targeted victims. |
| Exploit ScenarioDerived | An attacker crafts a URL pointing at a vulnerable VikRentCar endpoint with a malicious script payload in a reflected parameter and delivers it to a victim (for example a site administrator or booking user) via email or a link. When the victim opens the link, the unsanitized input is reflected into the generated page and executes in their browser session, potentially stealing session data or performing actions as that user. No verified public exploit code is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority.
RemediationAI
No vendor-released fixed version is identified in the provided data; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerability/wordpress-vikrentcar-plugin-1-4-8-cross-site-scripting-xss-vulnerability-2) is the record to monitor for a patched VikRentCar release, and moving the plugin to any version published above 1.4.8 once it exists is the complete fix. Because the vulnerable parameter or endpoint is not identified in the available sources, no targeted virtual-patch or WAF signature can be derived from this intelligence, and the data lists no vendor workaround. As a compensating measure where updating is not yet possible, XSS inspection/filtering at a reverse proxy or WAF can reduce the likelihood of reflected payloads reaching users, at the cost of false positives on legitimate request parameters; hardening the plugin endpoint cannot be scoped precisely until the reflecting parameter is documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-79 (Improper Neutralization of Input During Web Page Generation) in a PHP-based WordPress plugin, where request data echoed into the HTML response is not encoded/escaped, allowing script injection through a crafted URL. It is a reflected variant: the payload is not persisted in the database, so each victim must be individually enticed into following a malicious link, and the script runs in the origin of the WordPress site, which is why the assessed vector carries S:C with low C/I/A. The affected-product CPE is cpe:2.3:a:e4jvikwp:vikrentcar:*:*:*:*:*:*:*:* with the description bounding affected releases at 1.4.8 and earlier; the specific plugin parameter or endpoint that reflects the unsanitized input is not described in the available sources, so the exact request shape cannot be reproduced from this intelligence alone. Authentication is not required of the attacker (PR:N), and the assessment vector removes the A:L component present in the reported 7.1 score, reflecting the absence of evidence for an availability impact.
Know when Vikrentcar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS over the network (PR:N, AV:N, AC:L) but requires victim to click a crafted link (UI:R); script runs in the victim's browser crossing a trust boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Executive ViewAI
A high-severity reflected cross-site scripting flaw in the VikRentCar WordPress plugin (versions through 1.4.8) enables remote attackers to inject malicious scripts into a victim's browser via a crafted link. This puts site visitors and administrators at risk of session hijacking, credential theft, or redirection to malicious sites, potentially damaging customer trust and exposing sensitive data. Leadership should prioritize remediation given the plugin's public-facing nature and the absence of a vendor patch.
Deploy WAF rules to detect and block reflected XSS patterns targeting the plugin; enforce strict output encoding and input validation where possible; restrict administrative access to trusted networks; conduct user awareness training on phishing links; consider temporarily disabling the plugin until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Vikrentcar
View allThe VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, whic
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. Rated c
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers
Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typical
Unauthenticated Insecure Direct Object References in the VikRentCar WordPress plugin versions 1.4.5 and earlier allow re
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnera
Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted pa
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB