VikRentCar CVE-2026-116405

Exploitation requires the attacker to deliver a crafted input/URL to the VikRentCar WordPress plugin (version 1.4.9 or earlier) and to induce a victim to trigger it - the CVSS UI:R metric confirms required user interaction, which is the primary limiting factor. No authentication is required (PR:N), so the request itself can come from an unauthenticated attacker, but the payload only takes effect once a victim loads the affected page/link, and impact is bounded to the victim's browser context (Low C/I/A, scope change). The exact feature, parameter, or endpoint that reflects the unsanitized input is not described in the available sources, so defenders cannot yet scope this to a specific plugin function or configuration; the practical limiter remains the need for victim interaction rather than a special non-default configuration.

Signals are moderate and internally consistent, pointing to a real but non-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 HIGH) describes a network-reachable flaw requiring no privileges but requiring victim interaction (UI:R), with a scope change and only Low confidentiality/integrity/availability impact - the hallmark profile of a reflected/user-interaction XSS rather than a server-compromising bug. The vuln.today decision label is 'this_week', which is a prioritize-but-not-drop-everything signal, not act_now or emergency. No EPSS score, no CISA KEV listing, and no verified working exploit are present in the input, so there is no public evidence of active exploitation or mass scanning; absence of these signals is not proof of safety but does argue against widespread automated abuse today. The UI:R requirement and the Low impact ceiling meaningfully cap real-world severity: an attacker cannot act fully autonomously and cannot (per the vector) achieve high-impact data theft or full takeover through this flaw alone. Net: a genuine issue worth patching within the vendor's advised timeframe, but not a high-CVSS-masking-low-risk anomaly nor a drop-everything incident - its danger is bounded by the need to lure a victim into triggering the payload.

An unauthenticated attacker crafts a URL or form input carrying a malicious script payload that the VikRentCar plugin reflects back into a rendered page without proper sanitization. When a victim (a site visitor or an authenticated administrator) is lured into opening the crafted link, the script executes in their browser in the context of the WordPress site, enabling session/cookie theft, UI redressing, or actions performed as the victim. No verified public exploit code is present in the input; the only reference is a Patchstack database advisory, and the exact injection point and parameter are not described in the available sources.