Stored Cross-Site Scripting in VikRentCar Car Rental Management System Plugin for WordPress
CVE-2026-116548

7.2HIGH

Key Information:

Vendor

WordPress
Status
Vikrentcar Car Rental Management System
Vendor
CVE Published:
31 October 2026

What is CVE-2026-116548?

The VikRentCar Car Rental Management System plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the 'optionals' parameter. This issue arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to insert arbitrary web scripts. Consequently, these scripts can be executed when users navigate to affected pages, posing significant security risks to the integrity and confidentiality of the web application.

Affected Version(s)

VikRentCar Car Rental Management System 0 <= 1.4.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/vikrentcar/tag...
https://plugins.trac.wordpress.org/browser/vikrentcar/tag...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Junbo Zhuo
.