Reflected Cross-Site Scripting in VikRentItems Flexible Rental Management System for WordPress
CVE-2025-14049

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: Vikrentitems Flexible Rental Management System
Vendor: CVE Published:; 12 December 2025

What is CVE-2025-14049?

The VikRentItems Flexible Rental Management System plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability via the 'delto' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 1.2.0. An attacker can exploit this vulnerability by convincing a user to click on a manipulated link, potentially leading to the execution of arbitrary web scripts on vulnerable pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

VikRentItems Flexible Rental Management System * <= 1.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/vikrentitems/t...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Dec 12, 2025
Vulnerability Reserved
Dec 4, 2025

Credit

Athiwat Tiprasaharn

JSON

WordPress