WordPress VikRentCar plugin suffers from improper neutralization of user input, allowing reflected cross‑site scripting (XSS). The flaw stems from unsanitized data being inserted into web pages, enabling attackers to inject malicious scripts that execute in the context of a victim’s browser. An attacker can use this to steal session cookies, deface the site, or redirect users to malicious destinations. Based on the description, it is inferred that the flaw can be triggered by an attacker submitting malicious input through a crafted URL or form.

All installations of the VikRentCar WordPress plugin up to version 1.4.8 are affected. The vulnerability applies to every release from the first version through and including 1.4.8. Users running the plugin on their WordPress sites should check their installed version and plan an upgrade if they are on a vulnerable release.

The CVSS score of 7.1 indicates a medium‑high severity, while the EPSS data is not available, so the precise likelihood of exploitation is unknown but potential is significant. The flaw is a reflected XSS that can be triggered via a crafted URL or form submission, implying a remote attack vector from any internet‑connected host. Based on the description, it is inferred that an attacker can trigger the XSS by creating a crafted URL or form submission that includes malicious script. The vulnerability is not listed in CISA’s KEV catalog, but its medium‑high severity warrants prompt action.