Stored Cross-Site Scripting Vulnerability in VikRentCar Car Rental Management System for WordPress

CVE-2026-115840

What is CVE-2026-115840?

The VikRentCar Car Rental Management System plugin for WordPress exhibits a security flaw that allows for Stored Cross-Site Scripting (XSS) through the 'poplink' parameter in all versions up to and including 1.4.9. This vulnerability arises from inadequate sanitization of user inputs and insufficient escaping of outputs. As a result, unauthenticated attackers can insert malicious web scripts that execute whenever a user accesses a compromised page. Notably, the process requires only a WordPress nonce (vikwp_nonce), which the plugin generates and makes available to unauthenticated users on the public booking-confirmation page. Consequently, attackers can obtain a valid nonce without needing a user account, facilitating the injection of harmful scripts.

References