Stored Cross-Site Scripting Vulnerability in VikRentCar WordPress Plugin

CVE-2026-116749

What is CVE-2026-116749?

The VikRentCar Car Rental Management System plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access and above to exploit insufficient input sanitization via the 'className' parameter. This flaw permits the injection of arbitrary web scripts that can execute whenever a user accesses an affected page. The wp_kses_post() function applied during save does not adequately neutralize the payload since the injection occurs within an HTML attribute context, enabling attackers to bypass protections by using a simple raw double-quote. Additionally, the block-comment JSON encoding of such quotes can be decoded back to a literal character when the page is rendered.

References