{
 "id": "WPSEC-2026-1310",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1310/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1310/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1310/index.md",
 "title": "VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Email",
 "description": "The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email address submitted with front-end rental orders in all versions up to, and including, 1.4.8, due to the email not being validated when the order is created and being echoed without escaping into the value attribute of the order cancellation form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user, such as an administrator using the view-order-on-front-end link, accesses the affected order details page.",
 "plugin": {
  "slug": "vikrentcar",
  "name": "VikRentCar Car Rental Management System",
  "full_name": "VikRentCar Car Rental Management System",
  "wordpress_org": "https://wordpress.org/plugins/vikrentcar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vikrentcar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vikrentcar"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.9",
 "remediation": "Update to 1.4.9 or later.",
 "fix_released": "2026-10-19T21:45:28+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:31.014516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1310/",
  "https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/",
  "https://wordpress.org/plugins/vikrentcar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikrentcar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}