What is the CVSS score of CVE-2026-16143?

CVE-2026-16143 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of VikRentItems WordPress Plugin are affected by CVE-2026-16143?

VikRentItems rental management plugin (WordPress, versions ≤1.2.1) contains a stored cross-site scripting vulnerability in customer email fields of public booking forms, allowing unauthenticated…

How to fix or mitigate CVE-2026-16143?

Within 24 hours: Verify whether VikRentItems version 1.2.1 or earlier is installed on your WordPress site; if present, immediately disable the plugin to halt further payload injection and review administrator panel access logs for suspicious activity. Within 7 days: Contact the plugin vendor to confirm patch timeline; implement input validation and output encoding on the customer email field in the booking system if continued operation is required, and audit existing orders in the database for stored malicious payloads. Within 30 days: Deploy the patched version of VikRentItems once released by the vendor, or migrate to an alternative rental management solution if the patch timeline extends beyond 30 days.

VikRentItems WordPress Plugin CVE-2026-16143

EUVD-2026-53036 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 Wordfence

GHSA-3v9q-ch5p-9639

WordPress XSS Wordpress Plugin Vikrentitems Flexible Rental Management System E4Jvikwp

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Injection is unauthenticated and network-accessible (PR:N, AV:N), but payload execution requires an admin to view the order (UI:R); scope changes to admin browser context (S:C).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 05:55 vuln.today

CVE Published

Aug 05, 2026 - 04:25 cve.org

HIGH 7.2

DescriptionCVE.org

The VikRentItems - Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the saveorder() function, which stores the raw email value via VikRequest::getString() (applying only sanitize_text_field(), which does not neutralize HTML attribute-breaking characters such as double quotes), and in the editorder template which echoes the stored custmail value into an HTML input element's value attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.

Technical ContextAI

The vulnerability resides in the VikRentItems WordPress plugin (vendor: e4jvikwp; CPE: cpe:2.3:a:e4jvikwp:vikrentitems_flexible_rental_management_system:*:*:*:*:*:*:*:*), a rental management solution extending the WordPress CMS. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting in two compounding defects: first, the saveorder() function at site/controller.php:L389 reads the email value using VikRequest::getString(), which internally applies WordPress's sanitize_text_field() - a function designed to strip tags and normalize whitespace but explicitly NOT intended to neutralize HTML attribute-breaking characters such as the double-quote ("). Second, the stored custmail value is echoed directly into the value attribute of an HTML input element in the admin/views/editorder/tmpl/default.php template at L499 without applying WordPress's esc_attr() output-escaping function, which is the canonical defense for this exact context. The gap between the sanitization step and the output context is the classic stored XSS pattern: input is accepted as 'clean text' but rendered in an HTML attribute context that requires a stricter escaping contract.

RemediationAI

A fix has been committed to the plugin's trunk in the WordPress plugin repository (changeset 3617300 modifying admin/views/editorder/tmpl/default.php), applying proper output escaping in the editorder template. However, a released patched version number has not been independently confirmed from the available source data - update to the latest available version in the WordPress plugin repository and verify the fix is present. Site administrators should update through the WordPress admin dashboard (Plugins → Update) as soon as a patched release is available. If immediate upgrade is not possible, a compensating control is to restrict access to the booking checkout form (e.g., via web server rules or a WAF rule blocking double-quote characters in email submission fields) and limit access to the WordPress admin order-view pages to trusted IP ranges only - both measures reduce the injection surface and execution opportunity respectively. Note that IP-restricting the admin panel alone does not prevent payload storage; both injection and rendering must be addressed.