Live › vulnerability › CVE-2026-28160
VikRentCar, a WordPress plugin for vehicle rental sites, has a cross-site scripting flaw in versions 1.4.10 and earlier. An anonymous visitor can inject script that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the VikRentCar WordPress plugin at 1.4.10 or earlier are listed as affected by NVD. Which input is vulnerable is not published in any source I could read. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vikrentcar | wordpress | <= 1.4.10 | – |
1.4.10 or earlier is listed as affected1.4.11 is current per Patchstack)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-28160")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.