Vikrentcar Car Rental Management System
Monthly
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions up to and including 1.4.10) allows unauthenticated attackers to submit a crafted 'optionals' value that is neither sanitized on input nor escaped on output, so the injected script is persisted and runs in the browser of any user who later loads the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N for a score of 7.2, reflecting a scope change into the victim's browser session and low confidentiality and integrity impact, with maximum consequences when the viewer is a logged-in administrator. No CISA KEV listing and no confirmed public exploit code are present in the available intelligence; vuln.today triage places this in the 'this_week' remediation queue, and upgrading to 1.4.11 removes the flaw.
Stored cross-site scripting in the VikRentCar Car Rental Management System WordPress plugin (all versions up to and including 1.4.9) lets remote attackers inject arbitrary script through the 'poplink' parameter, which is then rendered on public booking-confirmation and car-details pages. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C with low confidentiality and integrity impact, and the only access control in the path is a vikwp_nonce token that the plugin itself prints to unauthenticated visitors on the public booking-confirmation page, so no account is required. Execution still depends on a victim later loading an injected page; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is prioritised as 'this_week'.
Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.
Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions up to and including 1.4.10) allows unauthenticated attackers to submit a crafted 'optionals' value that is neither sanitized on input nor escaped on output, so the injected script is persisted and runs in the browser of any user who later loads the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N for a score of 7.2, reflecting a scope change into the victim's browser session and low confidentiality and integrity impact, with maximum consequences when the viewer is a logged-in administrator. No CISA KEV listing and no confirmed public exploit code are present in the available intelligence; vuln.today triage places this in the 'this_week' remediation queue, and upgrading to 1.4.11 removes the flaw.
Stored cross-site scripting in the VikRentCar Car Rental Management System WordPress plugin (all versions up to and including 1.4.9) lets remote attackers inject arbitrary script through the 'poplink' parameter, which is then rendered on public booking-confirmation and car-details pages. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C with low confidentiality and integrity impact, and the only access control in the path is a vikwp_nonce token that the plugin itself prints to unauthenticated visitors on the public booking-confirmation page, so no account is required. Execution still depends on a victim later loading an injected page; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is prioritised as 'this_week'.
Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.
Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.