{"id":"CVE-2026-116405","kind":"vulnerability","aliases":["CVE-2026-116405"],"related":[],"title":"VikRentCar WordPress plugin: unauthenticated XSS through versions 1.4.9","description":"Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.","summary":"VikRentCar, a WordPress car rental plugin, has a cross-site scripting flaw in versions up to and including 1.4.9 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["car-rental","package","vikrentcar","wordpress"],"not_affected_if":["plugin-not-installed","version-above-1.4.9"],"how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin under Plugins.\n- Confirm whether the installed version is `1.4.9` or older.","fix":"- VikRentCar: a version newer than `1.4.9` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-10-30T19:18:14+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:10+00:00","updated_at":"2026-10-30T19:26:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:10Z","model":"claude-haiku-5-5","output":{"fix":"- VikRentCar: a version newer than `1.4.9` (the sources do not name the exact fixed release).","reach":"internet","title":"VikRentCar WordPress plugin: unauthenticated XSS through versions 1.4.9","impact":"medium","summary":"VikRentCar, a WordPress car rental plugin, has a cross-site scripting flaw in versions up to and including 1.4.9 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vikrentcar","car-rental"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers, may hijack admin sessions","analyst_note":"Find the fixed VikRentCar version and the vulnerable parameter or page from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116405) or the vendor changelog.","how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin under Plugins.\n- Confirm whether the installed version is `1.4.9` or older.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.4.9"],"who_is_affected":"Sites running the VikRentCar plugin at version 1.4.9 or older. The sources do not say which page or input is affected, so the team should treat any public booking page using the plugin as exposed until it is updated.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4066,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116405':11A,14A '-2026':10A,13A '1.4.9':8A,40B,67C 'administr':57B 'attack':46B 'browser':59B 'car':16B,24B 'car-rent':15B 'cross':30B,61C 'cross-sit':29B 'cve':9A,12A 'flaw':33B 'includ':39B 'inject':48B 'login':44B 'need':42B 'packag':18B 'plugin':3A,26B 'rental':17B,25B 'run':51B 'script':32B,49B,63C 'site':31B,62C 'unauthent':4A,60C 'version':7A,35B,68C 'vikrentcar':1A,19B,21B,66C 'visitor':54B 'wordpress':2A,20B,23B 'xss':5A,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikRentCar plugin at version 1.4.9 or older. The sources do not say which page or input is affected, so the team should treat any public booking page using the plugin as exposed until it is updated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116405","severity":null,"published_at":"2026-10-30T19:18:14+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}