{"id":"CVE-2026-28160","kind":"vulnerability","aliases":["CVE-2026-28160"],"related":[],"title":"VikRentCar WordPress plugin: unauthenticated XSS through an unknown input","description":"Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.","summary":"VikRentCar, a WordPress plugin for vehicle rental sites, has a cross-site scripting flaw in versions 1.4.10 and earlier. An anonymous visitor can inject script that runs in other users' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vikrentcar","fixed":[],"affected":"<= 1.4.10","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","rental-sites","vikrentcar","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin under Plugins, check the VikRentCar version; 1.4.10 or earlier is listed as affected. Or run: wp plugin get vikrentcar --field=version","fix":"Update VikRentCar to the latest release (1.4.11 is current per Patchstack). Not confirmed by the vendor as the fix for this specific CVE.","status":"open","published_at":"2026-10-30T19:18:23+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:06+00:00","updated_at":"2026-10-30T19:30:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VikRentCar WordPress plugin: unauthenticated XSS through an unknown input","impact":"medium","summary":"VikRentCar, a WordPress plugin for vehicle rental sites, has a cross-site scripting flaw in versions 1.4.10 and earlier. An anonymous visitor can inject script that runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vikrentcar","rental-sites"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers, session data can be stolen","analyst_note":"Find the vulnerable input and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-28160 and the plugin's changelog.","how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin under Plugins; versions `1.4.10` and earlier are listed as affected.\n- unknown for other checks; the sources do not say which input or page is vulnerable.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the VikRentCar plugin at version 1.4.10 or earlier are exposed. The sources do not say which pages or inputs are vulnerable, so the exact data path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4066,"output_tokens":540,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vulnerable input and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-28160 and the plugin's changelog.","search":"'-2026':11A,14A '-28160':12A,15A '1.4.10':40B,62C 'anonym':44B 'browser':54B 'cross':34B,56C 'cross-sit':33B 'cve':10A,13A 'earlier':42B 'flaw':37B 'inject':47B 'input':9A 'packag':17B 'plugin':3A,26B 'rental':19B,29B 'rental-sit':18B 'run':50B 'script':36B,48B,58C 'site':20B,30B,35B,57C 'unauthent':4A,55C 'unknown':8A 'user':53B 'vehicl':28B 'version':39B,63C 'vikrentcar':1A,16A,21B,23B,61C 'visitor':45B 'wordpress':2A,22B,25B 'xss':5A,59C","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikRentCar WordPress plugin at 1.4.10 or earlier are listed as affected by NVD. Which input is vulnerable is not published in any source I could read. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28160","severity":null,"published_at":"2026-10-30T19:18:23+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28160:1196","url":null,"severity":null,"published_at":"2026-10-30T19:30:04+00:00","modified_at":"2026-10-30T19:30:04+00:00","first_seen_at":"2026-10-30T19:30:04+00:00","fetched_at":"2026-10-30T19:30:04+00:00","note":"NVD page unreadable; no primary advisory found tying this CVE to a specific input. Patchstack (CNA) lists VikRentCar <=1.4.10 with 1.4.11 as latest release, but its 1.4.10 entries are Contributor+ stored XSS/SQLi, not unauthenticated, so mapping to this CVE is unconfirmed. Siblings: CVE-2026-39790 (fixed 1.4.8), CVE-2026-112835/112838 (<=1.4.8), CVE-2026-116749 (className, fixed 1.4.11). Nothing verified; no PoC or exploitation found."}],"documents":[{"id":25513,"url":"https://wordpress.org/plugins/vikrentcar/","title":"VikRentCar plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":25514,"url":"https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerabilities","title":"Patchstack: VikRentCar vulnerability history (latest 1.4.11)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}