The VikRentCar plugin (versions up to 1.4.8) contains an improper neutralization of input during web page generation that allows an attacker to inject malicious JavaScript code. The flaw is a stored cross‑site scripting (XSS) vulnerability, meaning injected scripts are saved in the database and subsequently rendered in pages viewed by other users. If executed, the attacker can steal session cookies, perform phishing or deface pages, and potentially gain unauthorized access to the WordPress administration area if an administrator views the infected page.

Any WordPress site that has the VikRentCar plugin installed and running version 1.4.8 or earlier is affected. The plugin is distributed by the vendor e4jvikwp and supports all WordPress installations that deploy VikRentCar for vehicle rental management. There is no indication that specific WordPress core versions are required; the vulnerability exists solely in the plugin code.

The CVSS score of 7.1 reflects the high impact of a stored XSS flaw combined with a medium‑to‑high exploitation likelihood. The EPSS score is not available, but stored XSS tends to be a common attack vector and could be exploited by anyone who can submit data to the plugin’s input fields, which are typically public‑facing booking or comment forms. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. However, the potential for defacement, credential theft, and session hijacking makes immediate remediation advisable.