Public vulnerability disclosure

CVE-2026-28160

WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

publishedCWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.

Investigate in Cyber JSON Markdown

Technical severity7.1 highCVSS 3.1 · CNA: Patchstack

Published2026-10-30Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

Update the WordPress VikRentCar plugin to the latest available version (at least 1.4.11).

Source: CNA: Patchstack

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
VikRentCar e4jvikwp `vikrentcar` https://wordpress.org/plugins	≥ 0; ≤ 1.4.10 (affected, custom); unaffected at 1.4.11 Other versions: unaffected	CNA: Patchstack

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 7.1 high	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L`	CNA: Patchstack

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerability/wordpress-vikrentcar-plugin-1-4-10-cross-site-scripting-xss-vulnerability?_s_id=cveCNA: Patchstack · vdb-entry