VikRentCar (<= 1.4.9) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vikrentcar--1.4.9/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:52:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVikWP VikRentCar: Stored Cross-Site Scripting (CVE-2026-115840)https://feed.craftedsignal.io/briefs/2026-10-115840/Sat, 31 Oct 2026 07:52:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-115840/The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.The VikRentCar WordPress plugin (up to and including version 1.4.9) fails to properly sanitize the 'poplink' parameter, allowing for Stored Cross-Site Scripting (XSS). An unauthenticated attacker can retrieve the required 'vikwp_nonce' token from the publicly accessible booking-confirmation page and subsequently inject malicious scripts into the application. These scripts execute in the browser of any user who accesses the compromised page.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into WordPress pages. This can lead to session hijacking, unauthorized actions performed on behalf of site administrators, or the redirection of visitors to malicious sites.

Recommendation

  • Update the VikRentCar plugin to the latest available version beyond 1.4.9 immediately to remediate the input sanitization flaw.
  • Implement a Web Application Firewall (WAF) rule to inspect and block POST requests containing script-like payloads in the 'poplink' parameter.
  • Audit the booking-confirmation page logs for repetitive requests that appear to be harvesting 'vikwp_nonce' tokens.
]]>highadvisorywordpressxssweb-application-vulnerability