Vikrentitems Flexible Rental Management System
Monthly
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.