E4Jvikwp
Monthly
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions up to and including 1.4.10) allows unauthenticated attackers to submit a crafted 'optionals' value that is neither sanitized on input nor escaped on output, so the injected script is persisted and runs in the browser of any user who later loads the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N for a score of 7.2, reflecting a scope change into the victim's browser session and low confidentiality and integrity impact, with maximum consequences when the viewer is a logged-in administrator. No CISA KEV listing and no confirmed public exploit code are present in the available intelligence; vuln.today triage places this in the 'this_week' remediation queue, and upgrading to 1.4.11 removes the flaw.
Stored cross-site scripting in the VikRentCar Car Rental Management System WordPress plugin (all versions up to and including 1.4.9) lets remote attackers inject arbitrary script through the 'poplink' parameter, which is then rendered on public booking-confirmation and car-details pages. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C with low confidentiality and integrity impact, and the only access control in the path is a vikwp_nonce token that the plugin itself prints to unauthenticated visitors on the public booking-confirmation page, so no account is required. Execution still depends on a victim later loading an injected page; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is prioritised as 'this_week'.
Unauthenticated cross-site scripting in the VikRentCar WordPress plugin affects versions up to and including 1.4.9, letting a remote attacker get script executed inside a victim's browser session in the context of the affected site. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms no authentication is required, but the attacker must induce a victim to load a crafted page or link, and the resulting impact is bounded to low confidentiality, integrity and availability effects with a scope change out of the vulnerable component. No CISA KEV listing and no public exploit reference appear in the supplied data, and the priority signal is this_week rather than an emergency.
Cross-site scripting in the WordPress VikRentCar plugin through version 1.4.10 allows remote attackers to inject content that is rendered in a victim’s browser, but exploitation requires the victim to open attacker-controlled input or a crafted link rather than occurring automatically. No authentication is required (PR:N per the CVSS vector), yet impact stays within the victim’s browser/WordPress session context; the CVSS 7.1 score is elevated mainly by scope change (S:C) and network access, while confidentiality, integrity, and availability impacts are Low, with the independent assessment setting availability to None. Patchstack reported the issue and the vuln.today decision label is this_week; no CISA KEV entry is present and no public exploit identified at time of analysis.
Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.
Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority.
Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted payload that executes when a victim views the affected page. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the vector indicates network reachability and no required privileges, but exploitation depends on user interaction with the stored content. No public exploit is identified at time of analysis, and the available source does not specify the vulnerable input field or the exact privilege needed to inject the payload.
Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated remote attackers persist arbitrary JavaScript via the 'email' parameter, which then executes in the browser of any user - including hotel staff and admins - who later views the affected page. Because the injection point is reachable without authentication and the payload is stored server-side, it enables session hijacking, admin action forgery, and content defacement against booking-management back offices. This issue is not in CISA KEV and no public exploit has been identified at time of analysis.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated attackers persist arbitrary JavaScript via the 'special_requests' booking field, which then executes when a hotel operator or user views the injected order in the admin back-end. Reported by Wordfence with a CVSS 7.2 (scope-changed) rating; no public exploit identified at time of analysis and it is not listed in CISA KEV. The fix landed in version 1.8.9, whose patched source is referenced in the advisory.
Arbitrary file deletion in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to and including 1.8.12) is reachable via a cross-site request forgery flaw that lets an attacker abuse a path-traversal-capable file operation. By tricking a logged-in administrator into visiting a malicious page, a remote unauthenticated attacker can forge a request that deletes arbitrary files on the WordPress host, potentially disabling the site. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Unauthenticated Insecure Direct Object References in the VikRentCar WordPress plugin versions 1.4.5 and earlier allow remote attackers to access sensitive resources belonging to other users by manipulating predictable object identifiers. The flaw was disclosed via Patchstack and affects WordPress sites running the e4jvikwp VikRentCar booking plugin, with no public exploit identified at time of analysis but a high CVSS confidentiality impact reflecting potential exposure of booking, customer, or reservation data.
VikRestaurants plugin versions up to and including 1.5.2 contain a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by users. The vulnerability affects the e4jvikwp VikRestaurants product, a restaurant management and booking plugin primarily used in WordPress environments. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, resulting in credential theft, session hijacking, or defacement of the restaurant website.
Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.
Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.12) allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by tricking them into clicking a crafted URL. The vulnerable `layoutstyle` parameter is insufficiently sanitized before being rendered in the roomslist view template, enabling session hijacking, credential theft, or malicious redirects against authenticated site users such as hotel administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, and a patched version (1.8.13) is available per plugin Trac references.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions up to and including 1.4.10) allows unauthenticated attackers to submit a crafted 'optionals' value that is neither sanitized on input nor escaped on output, so the injected script is persisted and runs in the browser of any user who later loads the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N for a score of 7.2, reflecting a scope change into the victim's browser session and low confidentiality and integrity impact, with maximum consequences when the viewer is a logged-in administrator. No CISA KEV listing and no confirmed public exploit code are present in the available intelligence; vuln.today triage places this in the 'this_week' remediation queue, and upgrading to 1.4.11 removes the flaw.
Stored cross-site scripting in the VikRentCar Car Rental Management System WordPress plugin (all versions up to and including 1.4.9) lets remote attackers inject arbitrary script through the 'poplink' parameter, which is then rendered on public booking-confirmation and car-details pages. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C with low confidentiality and integrity impact, and the only access control in the path is a vikwp_nonce token that the plugin itself prints to unauthenticated visitors on the public booking-confirmation page, so no account is required. Execution still depends on a victim later loading an injected page; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is prioritised as 'this_week'.
Unauthenticated cross-site scripting in the VikRentCar WordPress plugin affects versions up to and including 1.4.9, letting a remote attacker get script executed inside a victim's browser session in the context of the affected site. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms no authentication is required, but the attacker must induce a victim to load a crafted page or link, and the resulting impact is bounded to low confidentiality, integrity and availability effects with a scope change out of the vulnerable component. No CISA KEV listing and no public exploit reference appear in the supplied data, and the priority signal is this_week rather than an emergency.
Cross-site scripting in the WordPress VikRentCar plugin through version 1.4.10 allows remote attackers to inject content that is rendered in a victim’s browser, but exploitation requires the victim to open attacker-controlled input or a crafted link rather than occurring automatically. No authentication is required (PR:N per the CVSS vector), yet impact stays within the victim’s browser/WordPress session context; the CVSS 7.1 score is elevated mainly by scope change (S:C) and network access, while confidentiality, integrity, and availability impacts are Low, with the independent assessment setting availability to None. Patchstack reported the issue and the vuln.today decision label is this_week; no CISA KEV entry is present and no public exploit identified at time of analysis.
Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.
Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority.
Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted payload that executes when a victim views the affected page. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the vector indicates network reachability and no required privileges, but exploitation depends on user interaction with the stored content. No public exploit is identified at time of analysis, and the available source does not specify the vulnerable input field or the exact privilege needed to inject the payload.
Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated remote attackers persist arbitrary JavaScript via the 'email' parameter, which then executes in the browser of any user - including hotel staff and admins - who later views the affected page. Because the injection point is reachable without authentication and the payload is stored server-side, it enables session hijacking, admin action forgery, and content defacement against booking-management back offices. This issue is not in CISA KEV and no public exploit has been identified at time of analysis.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated attackers persist arbitrary JavaScript via the 'special_requests' booking field, which then executes when a hotel operator or user views the injected order in the admin back-end. Reported by Wordfence with a CVSS 7.2 (scope-changed) rating; no public exploit identified at time of analysis and it is not listed in CISA KEV. The fix landed in version 1.8.9, whose patched source is referenced in the advisory.
Arbitrary file deletion in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to and including 1.8.12) is reachable via a cross-site request forgery flaw that lets an attacker abuse a path-traversal-capable file operation. By tricking a logged-in administrator into visiting a malicious page, a remote unauthenticated attacker can forge a request that deletes arbitrary files on the WordPress host, potentially disabling the site. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Unauthenticated Insecure Direct Object References in the VikRentCar WordPress plugin versions 1.4.5 and earlier allow remote attackers to access sensitive resources belonging to other users by manipulating predictable object identifiers. The flaw was disclosed via Patchstack and affects WordPress sites running the e4jvikwp VikRentCar booking plugin, with no public exploit identified at time of analysis but a high CVSS confidentiality impact reflecting potential exposure of booking, customer, or reservation data.
VikRestaurants plugin versions up to and including 1.5.2 contain a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by users. The vulnerability affects the e4jvikwp VikRestaurants product, a restaurant management and booking plugin primarily used in WordPress environments. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, resulting in credential theft, session hijacking, or defacement of the restaurant website.
Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.
Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.12) allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by tricking them into clicking a crafted URL. The vulnerable `layoutstyle` parameter is insufficiently sanitized before being rendered in the roomslist view template, enabling session hijacking, credential theft, or malicious redirects against authenticated site users such as hotel administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, and a patched version (1.8.13) is available per plugin Trac references.