The vulnerability is an instance of Reflected Cross‑Site Scripting, originating from insufficient input sanitization and output escaping of the 'delto' parameter. It allows an unauthenticated attacker to inject arbitrary JavaScript into web pages that the victim's browser will render, potentially enabling phishing, credential theft, or malicious script execution. The weakness aligns with CWE‑79 and can compromise user data and trust in the website.

The issue affects the VikRentItems Flexible Rental Management System plugin for WordPress, specifically all releases up to and including version 1.2.0. Users running a WordPress site with this plugin installed are susceptible; no other vendors or products are implicated by the available data.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA KEV, implying no confirmed large‑scale attacks yet. If an attacker can lure a user to interact with a specially crafted URL containing a malicious 'delto' payload, the XSS will occur on the victim's browser. The lack of authentication requirement and the reflected nature of the flaw make this an easily exploitable vector for phishing or script injection.