CVE-2026-116548: fallo de gravedad alta en e4jvikwp VikRentCar Car Rental Management System
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
43Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck.
ssvc Actcvss 7.2epss 0.2%
de la publicación al arma
Publicada en NVD31 oct
VulnCheck+2d
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
e4jvikwp · VikRentCar Car Rental Management SystemCVEs relacionadas — e4jvikwp VikRentCar Car Rental Management System
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-5322HIGHVikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.8%CVE-2025-13724HIGHVikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' ParameterEPSS 0.4%CVE-2024-11640HIGHVikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.3%CVE-2026-111120HIGHVikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX TaskEPSS 0.3%CVE-2026-116750MEDIUMVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block AttributeEPSS 0.3%CVE-2026-115840HIGHVikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' ParameterEPSS 0.2%
Referencias
https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/admin/views/editbusy/tmpl/default.php#L568https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L568https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L602https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L169https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L668https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4?source=cve