Live › vulnerability › CVE-2026-116405
VikRentCar, a WordPress car rental plugin, has a cross-site scripting flaw in versions up to and including 1.4.9 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the VikRentCar plugin at version 1.4.9 or older. The sources do not say which page or input is affected, so the team should treat any public booking page using the plugin as exposed until it is updated.
No product ranges from the sources yet.
1.4.9 or older.1.4.9 (the sources do not name the exact fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116405")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.