CVE-2026-116548

HighCVSS 7.2/10Last modified Nov 2, 2026

Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
e4jvikwp	VikRentCar Car Rental Management System	<= 1.4.10

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-116558.3Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process CVE-2026-1165516.4The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up t CVE-2026-1165524.7The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header CVE-2026-1165543.5A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components CVE-2026-1165552.4A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/f CVE-2026-1165562.4A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotati CVE-2026-1165579.1The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability CVE-2026-1165587.2The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside CVE-2026-116568.3Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious ext CVE-2026-1165626.4The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s[CVE-2026-1165635.4The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scriptin CVE-2026-1165665.3socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.