# VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Email

- **ID:** WPSEC-2026-1310
- **Plugin:** VikRentCar Car Rental Management System (`vikrentcar`), https://wordpress.org/plugins/vikrentcar/
- **Affected versions:** all versions before 1.4.9
- **Fixed in:** 1.4.9 (Update to 1.4.9 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikrentcar
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1310/

## Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email address submitted with front-end rental orders in all versions up to, and including, 1.4.8, due to the email not being validated when the order is created and being echoed without escaping into the value attribute of the order cancellation form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user, such as an administrator using the view-order-on-front-end link, accesses the affected order details page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1310/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
- https://wordpress.org/plugins/vikrentcar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1310/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.