CVE-2026-115840
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The VikRentCar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in versions up to 1.4.9 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin emits to unauthenticated visitors on the public booking-confirmation page.
Risk Assessment
Potential execution of malicious JavaScript in the user's browser, which could lead to session or data theft. The risk applies to sites using the VikRentCar plugin.
Recommendation
Update the VikRentCar plugin to a version later than 1.4.9. If updating is not possible, consider restricting access to public booking pages.
Other vulnerabilities in VikRentCar
See all- CVE-2026-112836High
Cross-Site Request Forgery (CSRF) vulnerability in the e4jvikwp VikRentCar plugin through version 1.4.8. The vulnerability allows unwanted actions to be performed on behalf of a logged-in user.
- CVE-2026-28160High
The VikRentCar plugin (e4jvikwp) through version 1.4.10 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in a user's browser.
- CVE-2026-116405High
The VikRentCar plugin in versions up to 1.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.
- CVE-2026-112838High
The VikRentCar plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script stored in the application is later executed in users' browsers.
- CVE-2026-112835High
The VikRentCar plugin contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is reflected in the server response and executed in the victim's browser.
- CVE-2026-39790High
Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.
- CVE-2026-52699High
Versions of VikRentCar <= 1.4.5 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
Original NVD description (English source)
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin itself emits to unauthenticated visitors on the public booking-confirmation page, allowing an attacker to obtain a valid token without any account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS