VikRentCar EUVD-2026-114608

Requires the VikRentCar Car Rental Management System plugin installed at version 1.4.9 or earlier. The attacker needs a valid vikwp_nonce token, but this is not a meaningful barrier: the plugin emits that nonce to unauthenticated visitors on the public booking-confirmation page, so no account or authentication is needed. The malicious script is injected via the 'poplink' parameter and is stored in the plugin's booking-confirmation (oconfirm) and car-details pages. The limiting factor is that execution occurs only when a user actually loads one of those injected public pages - so it depends on a victim (another visitor or an administrator) subsequently viewing the page - and on the vulnerable version being deployed; it works against default configurations since the triggering pages are public-facing.

This is a genuine but mid-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) describes a remotely reachable, low-complexity flaw needing no privileges, and the scope change (S:C) plus the fact that the required vikwp_nonce is handed to unauthenticated visitors on the public booking-confirmation page are what push it above a typical authenticated-XSS score - the nonce gate is effectively not a barrier. However, impact is limited to C:L/I:L with no availability impact, consistent with stored XSS rather than code execution. On the exploitation side the signals are modest: this is not in CISA KEV, no EPSS probability was supplied in the input (so widespread-exploitation likelihood cannot be quantified here), and no public exploit identified at time of analysis - the references are the Wordfence advisory and WordPress trac source, not working exploit code. The vuln.today decision label is this_week, not act_now/emergency, which aligns with a patch-this-cycle posture rather than drop-everything. Net: a real, unauthenticated, network-reachable stored XSS worth remediating promptly, but its bounded impact and absence of KEV/EPSS/PoC signals keep it below emergency tier.

An unauthenticated attacker first loads the plugin's public booking-confirmation page to obtain a valid vikwp_nonce, then submits a request with a malicious script in the 'poplink' parameter, which is stored and rendered without sufficient sanitization or output escaping. The payload then executes in the browser of any user - a visitor or an administrator - who subsequently views the affected booking-confirmation or car-details page. No public exploit identified at time of analysis, though the trigger path is fully described in the Wordfence advisory.