VikRentItems WordPress Plugin CVE-2026-16143

The VikRentItems plugin must be installed and active on a WordPress site with the public booking checkout form accessible to unauthenticated visitors - this is the standard deployment mode for a rental management plugin. The attacker requires no authentication, credentials, or special privileges to inject the payload. Payload execution requires a WordPress authenticated user (typically an administrator or editor with access to the WooCommerce/VikRentItems order management interface) to navigate to and view the affected order record in the admin panel - this represents a UI interaction constraint that limits exploitation to scenarios where an admin reviews the malicious booking. There is no requirement for any non-default plugin configuration; the vulnerable code path is exercised by the standard checkout and order-view workflows.

The CVSS 3.1 base score of 7.2 is calculated from the vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The PR:N and AV:N metrics are well-grounded - the booking checkout form is publicly accessible by design, requiring no authentication to submit. The S:C (Scope Changed) metric is appropriate because the stored payload executes in the browser context of an authenticated WordPress user, crossing a security boundary. However, the UI:N rating warrants scrutiny: while injection requires no user interaction from the attacker's perspective, payload execution is contingent on an administrator actively navigating to and viewing the injected order - a requirement more consistent with UI:R under CVSS 3.1 conventions for stored XSS. This assessor rates UI:R as more accurate, which would yield a score of approximately 6.1 rather than 7.2. EPSS data was not provided in the source intelligence. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified. Despite the absence of observed exploitation, the low attack complexity, unauthenticated injection surface, and admin-context execution make this a realistic risk for any WordPress site running an affected version of the plugin with public booking functionality exposed.

An unauthenticated attacker submits a booking request through the public VikRentItems checkout form with a crafted email value such as x" onmouseover="alert(document.cookie)" x=", which bypasses sanitize_text_field() and is persisted to the database. When a WordPress administrator subsequently opens the order detail page in the admin panel, the stored payload is rendered unescaped inside an HTML input attribute, causing the injected JavaScript to execute in the administrator's authenticated browser session - enabling session cookie theft, credential harvesting, or further WordPress admin-level actions.