VikRentCar CVE-2026-116749

Requires an authenticated WordPress account with contributor-level capability or higher on a site running VikRentCar Car Rental Management System ≤1.4.10. The attacker injects into the 'className' parameter of the VikRentCar widget (libraries/adapter/module/widget.php); the payload survives save-time sanitization because wp_kses_post() does not neutralize a raw double-quote in an HTML-attribute context, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time. Limiting factors: exploitation requires a valid contributor+ account (not unauthenticated), and the stored script fires only when a user subsequently loads the injected page. No non-default configuration is stated as required.

This is a moderate-severity stored XSS (CWE-79) with CVSS 6.4, and the signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C confirms network-reachable, low-complexity exploitation that nevertheless requires authentication (PR:L - the description specifies contributor-level access and above), with a changed scope reflecting that the injected script executes in the browser of other users who view the page. Impact is limited (C:L/I:L/A:N), which is typical for stored XSS. The decision framework places this at 'this_month' priority (vuln.today), not act_now or emergency, and there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation. No PoC or exploit reference is present in the input - the references are the Wordfence advisory and WordPress plugin source/trac links, not exploit code. Net assessment: a real but lower-tier issue - the contributor-account prerequisite and limited impact mean it is not a drop-everything priority, but on multi-author WordPress sites where contributor accounts are loosely granted, a self-registered or compromised contributor can escalate reach via stored script. Patch within the normal monthly cycle. Note: EPSS is absent from the input, so widespread-exploitation probability cannot be quantified from available data.

An attacker who holds (or obtains via open registration) a WordPress contributor account submits content through the VikRentCar widget, injecting a malicious payload into the 'className' parameter that survives wp_kses_post() because it lands in an HTML-attribute context and is later decoded by do_blocks() at render time. The script then executes in the browser of any user - including administrators - who views the injected page, enabling session/cookie theft or admin-context actions. No public exploit code is identified in the input, though the flaw mechanism is documented in detail by Wordfence.