{"id":"CVE-2026-112835","kind":"vulnerability","aliases":["CVE-2026-112835"],"related":[],"title":"VikRentCar WordPress plugin: reflected XSS through 1.4.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.","summary":"VikRentCar, a WordPress car rental booking plugin by e4jvikwp, does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run script in a visitor's browser by getting them to open a crafted link.","severity":"high","cvss":7.1,"epss":0.00146,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikrentcar","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin under Plugins, or with `wp plugin get vikrentcar --field=version`\n- unknown whether the sources list specific affected endpoints","fix":"- Update VikRentCar to a version later than `1.4.8`; the sources do not name the fixed version\n- unknown whether a vendor patch or workaround is published","status":"open","published_at":"2026-10-23T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:31:20+00:00","updated_at":"2026-10-25T03:31:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update VikRentCar to a version later than `1.4.8`; the sources do not name the fixed version\n- unknown whether a vendor patch or workaround is published","reach":"internet","title":"VikRentCar WordPress plugin: reflected XSS through 1.4.8","impact":"medium","summary":"VikRentCar, a WordPress car rental booking plugin by e4jvikwp, does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run script in a visitor's browser by getting them to open a crafted link.","category":"package","nicknames":[],"who_cares":["wordpress","vikrentcar","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs script in visitor browsers, stealing sessions or actions","analyst_note":"Find the fixed VikRentCar version and the affected endpoints or parameters from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112835.","how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin under Plugins, or with `wp plugin get vikrentcar --field=version`\n- unknown whether the sources list specific affected endpoints","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the VikRentCar plugin at version 1.4.8 or earlier. The sources do not say which pages or parameters are exposed, so unknown whether a site without public booking pages is safe. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":3354,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112835':10A,13A '-2026':9A,12A '1.4.8':7A,86C 'affect':81C 'allow':36B,77C 'attack':43B 'book':25B 'browser':51B 'car':23B 'craft':58B 'cross':39B,69C 'cross-sit':38B,68C 'cve':8A,11A 'e4jvikwp':28B,74C 'generat':67C 'get':53B 'host':17B 'improp':60C 'input':32B,63C 'issu':80C 'link':59B 'n/a':84C 'neutral':31B,61C 'open':56B 'packag':14B 'page':35B,66C 'plugin':3A,26B 'reflect':4A,37B,78C 'rental':24B 'run':45B 'script':41B,46B,71C 'self':16B 'self-host':15B 'site':40B,70C 'vikrentcar':1A,18B,20B,75C,76C,82C 'visitor':49B 'vulner':72C 'web':65C 'wordpress':2A,19B,22B 'xss':5A 'xss.this':79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikRentCar plugin at version 1.4.8 or earlier. The sources do not say which pages or parameters are exposed, so unknown whether a site without public booking pages is safe. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112835","severity":null,"published_at":"2026-10-23T09:17:05+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112835","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112835","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}