{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vikrentcar--1.4.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vikwp:vikrentcar:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-115840"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VikRentCar (\u003c= 1.4.9)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["VikWP"],"content_html":"\u003cp\u003eThe VikRentCar WordPress plugin (up to and including version 1.4.9) fails to properly sanitize the 'poplink' parameter, allowing for Stored Cross-Site Scripting (XSS). An unauthenticated attacker can retrieve the required 'vikwp_nonce' token from the publicly accessible booking-confirmation page and subsequently inject malicious scripts into the application. These scripts execute in the browser of any user who accesses the compromised page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject arbitrary web scripts into WordPress pages. This can lead to session hijacking, unauthorized actions performed on behalf of site administrators, or the redirection of visitors to malicious sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the VikRentCar plugin to the latest available version beyond 1.4.9 immediately to remediate the input sanitization flaw.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to inspect and block POST requests containing script-like payloads in the 'poplink' parameter.\u003c/li\u003e\n\u003cli\u003eAudit the booking-confirmation page logs for repetitive requests that appear to be harvesting 'vikwp_nonce' tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:52:10Z","date_published":"2026-10-31T07:52:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-115840/","summary":"The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.","title":"VikWP VikRentCar: Stored Cross-Site Scripting (CVE-2026-115840)","url":"https://feed.craftedsignal.io/briefs/2026-10-115840/"}],"language":"en","title":"CraftedSignal Threat Feed - VikRentCar (\u003c= 1.4.9)","version":"https://jsonfeed.org/version/1.1"}