VikRentCar CVE-2026-28160

Exploitation requires no authentication (PR:N) but DOES require victim interaction (UI:R): an attacker cannot trigger the flaw unassisted and must induce a user - a site visitor or logged-in administrator - to open attacker-controlled input/link against a site running VikRentCar 1.4.10 or earlier. The specific vulnerable parameter, endpoint, or whether the XSS is reflected versus stored is not described in the available sources. The principal limiting factors are the user-interaction requirement (no mass/automated exploitation) and the need for the target site to run an affected plugin version; because the impact only crosses into the victim's browser session, damage is bounded to that user's privileges in the WordPress context.

This is a moderate-severity reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) carrying a CVSS 7.1, where the score is inflated primarily by the scope change (S:C) and the network vector rather than by deep impact - confidentiality, integrity, and availability are each only Low. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required to deliver the attack, but the mandatory user interaction (UI:R) is the single most important mitigating signal: a victim must be lured into visiting attacker-crafted content for the payload to fire, which rules out automated, self-propagating mass exploitation. No EPSS score was supplied, so statistical exploitation probability cannot be weighed; no SSVC technical-impact/automatable breakdown was provided either. This is NOT in CISA KEV and there is no public exploit identified at time of analysis - the only reference is the Patchstack advisory, not working exploit code. The vendor/aggregator priority label is 'this_week', which places it above routine patching but below emergency/act_now; treat it as a scheduled-remediation item rather than a fire-drill. Net: a real but not urgent issue - a common WordPress-plugin XSS whose high numeric CVSS overstates practical risk given the user-interaction requirement and absence of exploitation evidence.

An attacker crafts a URL or form input for a VikRentCar-powered car-rental booking page that embeds a malicious script, then lures a site visitor or administrator into opening it (e.g., via a phishing message). When the victim's browser renders the unsanitized reflected input, the script executes in the context of the WordPress site, letting the attacker steal session tokens or perform actions as that user. No public exploit code is identified at this time; only the Patchstack advisory reference exists.