Reflected Cross-Site Scripting in VikRentItems Flexible Rental Management System for WordPress
CVE-2025-14049
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 December 2025
What is CVE-2025-14049?
The VikRentItems Flexible Rental Management System plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability via the 'delto' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 1.2.0. An attacker can exploit this vulnerability by convincing a user to click on a manipulated link, potentially leading to the execution of arbitrary web scripts on vulnerable pages.
Affected Version(s)
VikRentItems Flexible Rental Management System * <= 1.2.0