Skip to content
Threat Feed
Subscribe
high advisory

VikWP VikRentCar: Stored Cross-Site Scripting (CVE-2026-115840)

The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.

CVE search metadata

CVE search record: CVE-2026-115840. Severity: high. CVSS: 7.2. KEV: no. Product: VikRentCar (<= 1.4.9). Brief: VikWP VikRentCar: Stored Cross-Site Scripting (CVE-2026-115840). Brief link: https://feed.craftedsignal.io/briefs/2026-10-115840/

Triage facts

Revision 1
Applicability
VikRentCar (<= 1.4.9)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 31, 07:52 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

The VikRentCar WordPress plugin (up to and including version 1.4.9) fails to properly sanitize the 'poplink' parameter, allowing for Stored Cross-Site Scripting (XSS). An unauthenticated attacker can retrieve the required 'vikwp_nonce' token from the publicly accessible booking-confirmation page and subsequently inject malicious scripts into the application. These scripts execute in the browser of any user who accesses the compromised page.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into WordPress pages. This can lead to session hijacking, unauthorized actions performed on behalf of site administrators, or the redirection of visitors to malicious sites.

Recommendation

  • Update the VikRentCar plugin to the latest available version beyond 1.4.9 immediately to remediate the input sanitization flaw.
  • Implement a Web Application Firewall (WAF) rule to inspect and block POST requests containing script-like payloads in the 'poplink' parameter.
  • Audit the booking-confirmation page logs for repetitive requests that appear to be harvesting 'vikwp_nonce' tokens.

Immediate actions

Upgrade VikRentCar plugin to the version after 1.4.9.

IT Operations 48h

Threat Hunt

Hunt for incoming POST requests to WordPress pages that contain script tags or suspicious JavaScript event handlers in the query parameters.

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Apply WAF rules to block malicious script characters in POST request parameters.

immediate IT Operations

CVE-2026-115840

Detection coverage 1

Detects CVE-2026-115840 Exploitation - XSS via poplink parameter

high

Detects HTTP POST requests containing script tags or event handlers within the poplink parameter, indicative of XSS exploitation.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →