CVE-2026-39790
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or content modification.
Recommendation
Update the VikRentCar plugin to the latest patched version. Additionally, apply XSS filters at the application level.
Other vulnerabilities in VikRentCar
See all- CVE-2026-112836High
Cross-Site Request Forgery (CSRF) vulnerability in the e4jvikwp VikRentCar plugin through version 1.4.8. The vulnerability allows unwanted actions to be performed on behalf of a logged-in user.
- CVE-2026-52699High
Versions of VikRentCar <= 1.4.5 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS