Vulnerabilities / VikRentCar Car Rental Management System / WPSEC-2026-1310
VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Email
High 7.2
CWE-79Fixed in 1.4.9
- ID
- WPSEC-2026-1310
- Plugin
- VikRentCar Car Rental Management System (vikrentcar)
- Affected
- all versions before 1.4.9
- Remediation
- Update to 1.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- VikRentCar Car Rental Management System on WPSec AttackSurface
- Fix released
- Published
Description
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email address submitted with front-end rental orders in all versions up to, and including, 1.4.8, due to the email not being validated when the order is created and being echoed without escaping into the value attribute of the order cancellation form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user, such as an administrator using the view-order-on-front-end link, accesses the affected order details page.
References
- https://wpsec.com/vuln/WPSEC-2026-1310/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
- https://wordpress.org/plugins/vikrentcar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS