# VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via Booking Optionals

- **ID:** WPSEC-2026-1855
- **Plugin:** VikRentCar Car Rental Management System (`vikrentcar`), https://wordpress.org/plugins/vikrentcar/
- **Affected versions:** all versions before 1.4.11
- **Fixed in:** 1.4.11 (Update to 1.4.11 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikrentcar
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1855/

## Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the optionals (car options) data submitted in the front-end booking flow in all versions up to, and including, 1.4.10. This is due to insufficient input sanitization of the submitted option id:quantity pairs and missing output escaping when the stored quantity is rendered in the administrator's edit-booking view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator opens the affected booking.

## References

- https://wpsec.com/vuln/WPSEC-2026-1855/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.11/
- https://wordpress.org/plugins/vikrentcar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1855/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.