Live › vulnerability › CVE-2026-112838
Go to dashboardVikRentCar, a WordPress rental booking plugin by e4jvikwp, does not neutralize some user input before rendering it in pages, so stored cross-site scripting is possible. An attacker who can submit that input can run script in the browser of anyone who later views the affected page, such as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running VikRentCar version 1.4.8 or earlier are affected. Exposure is highest where public visitors can submit data that is later shown in the admin area, because a stored payload then runs in an administrator's browser. Sites without the plugin can skip it.
No product ranges from the sources yet.
vikrentcar.php1.4.8; the sources say versions through 1.4.8 are affected, and fixed versions are unknown1.4.8 once the vendor publishes one (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-112838")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.