VikRentCar CVE-2026-112838

Exploitation requires that an attacker-supplied value be stored through a VikRentCar input field and subsequently rendered to a viewer; the specific vulnerable field, parameter, and privilege needed for injection are not described in the available sources. The primary limiting factor is the required user interaction (UI:R): the stored payload only executes when a victim - plausibly a site administrator or booking-management staff - loads the page containing it, so impact depends on who views the affected content. The source's PR:N rating implies injection without authentication (consistent with a public booking form), but because the entry point is not documented, whether a low-privileged account is actually needed cannot be confirmed. Affected scope is VikRentCar versions from n/a through 1.4.8.

Signals are mixed and point to a moderate, non-emergency priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) describes a network-reachable stored XSS with low complexity, no required privileges per the source, but mandatory user interaction (a victim must render the stored payload) and a scope change reflecting execution in the victim's browser context. The vuln.today decision label is 'this_week', not act_now/emergency, which aligns with a serious-but-not-urgent posture. No EPSS score is provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV in the supplied data, so there is no confirmed active exploitation. The only reference is the Patchstack advisory database entry - an advisory, not verified working exploit code - so there is no public exploit identified at time of analysis. The PR:N rating implies unauthenticated injection, which for a car-rental booking plugin is plausible via public-facing booking forms, but the source does not describe the exact injection point, so whether injection truly requires no account versus a low-privileged role cannot be confirmed from the available data. Impact is bounded to Low across C/I/A, consistent with XSS rather than direct server compromise. Net: a legitimate stored-XSS issue worth patching on a normal cycle, not a high-CVSS-but-illusory risk, but also not evidence of mass or active exploitation.

An attacker submits a crafted value through a VikRentCar input that is stored without proper neutralization; later, a site administrator or staff member opens the page that renders that stored value, and the script executes in their authenticated browser session. No public exploit code is identified, only a Patchstack advisory reference. Because the CVSS vector requires user interaction (UI:R), execution waits until a victim views the affected page.