VikRentCar CVE-2026-39790

Exploitation requires victim user interaction (CVSS UI:R): a targeted user must click an attacker-crafted link or load an attacker-controlled page that triggers the reflected XSS against a WordPress site running VikRentCar ≤ 1.4.6. No authentication is required of the attacker (PR:N), and the attack is network-reachable (AV:N), but the mandatory user-interaction step is the primary limiting factor - there is no automatic, zero-click, or server-side code execution. Impact is confined to the victim's browser session in the site context; the exact vulnerable request parameter is not specified in the available data.

This is a moderate-severity (CVSS 7.1) unauthenticated Cross-Site Scripting flaw in the VikRentCar WordPress plugin (≤ 1.4.6), reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated exploitation, but critically requires user interaction (UI:R) - the victim must be lured into triggering the payload, which meaningfully lowers real-world exploitability versus a zero-click flaw. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) and only Low confidentiality/integrity/availability impacts are consistent with browser-context script execution rather than server compromise. Net assessment: a legitimate issue to patch, but a lower operational priority than a critical or actively-exploited bug - its real risk hinges on social engineering and the plugin's limited deployment footprint, not on worm-like mass exploitation. Note the A:L (availability) impact assigned by the source is questionable for a reflected XSS and is not independently corroborated.

An unauthenticated attacker crafts a malicious URL or web page containing a Cross-Site Scripting payload targeting a vulnerable VikRentCar endpoint and lures a user (e.g., a site visitor or logged-in administrator) into clicking it. When the victim's browser renders the reflected payload, attacker-controlled JavaScript executes in the site's context, enabling session/cookie theft, defacement, or actions on behalf of the victim. No public exploit code was identified in the provided data, and successful exploitation depends on the required user interaction (UI:R).