VikRentCar EUVD-2026-114612

Requires the VikRentCar Car Rental Management System plugin (version 1.4.10 or earlier) installed and active on WordPress, reachable so an unauthenticated attacker can supply the 'optionals' parameter through the booking/site controller flow. Injection itself needs no authentication (PR:N) and no special non-default configuration. The limiting factor is that the stored payload only fires when a user - a site visitor or an administrator - subsequently loads the page containing the injected content; impact is highest when an authenticated administrator views it. Upgrading to the fixed version 1.4.11 removes the flaw.

This is a stored (persistent) Cross-Site Scripting flaw (CWE-79) in the VikRentCar Car Rental Management System WordPress plugin, scored CVSS 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The network vector, low complexity, and crucially PR:N (unauthenticated) mean an attacker needs no account to inject the payload, which is the main driver of the elevated score; the scope change (S:C) reflects that the injected script executes in the context of other users/the site rather than only the vulnerable component, while C:L/I:L/A:N keeps impact moderate (session/data exposure and limited integrity, no availability loss). Counterbalancing signals temper urgency: no EPSS exploitation-probability score is provided, the CVE is NOT on CISA KEV, and no public exploit or PoC is listed in the input (only vendor advisory and source-code trac references). The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a genuine but non-emergency priority. Net assessment: a legitimately exploitable unauthenticated stored XSS worth patching promptly, but current evidence shows no confirmed active exploitation or published weaponized code, so this is a real-but-routine priority rather than a drop-everything incident. Note EPSS and KEV data are absent rather than low - treat the absence as a data gap, not confirmation of low risk.

An unauthenticated attacker submits a crafted value in the 'optionals' parameter during a car-rental booking interaction; because input is not sanitized and output is not escaped, the payload is stored and later rendered unescaped on plugin pages. When a visitor or administrator subsequently loads the affected page, the injected JavaScript executes in their browser, enabling session/cookie theft or actions in their authenticated context. No public exploit or PoC is identified in the provided data, but the low attack complexity (AC:L) and lack of authentication (PR:N) make exploitation straightforward.