Unauthenticated JavaScript injection was found in VikRentCar plugin versions 1.4.9 and earlier. The flaw allows an attacker to embed malicious script that executes in the browsers of any user who views the affected page, which can lead to session hijacking, credential theft, or defacement. The weakness corresponds to the standard input validation vulnerability identified as CWE-79.

The vulnerability affects the WordPress VikRentCar plugin from vendor e4jvikwp, specifically all releases up to and including version 1.4.9. WordPress sites that currently run these versions are at risk.

The CVSS score is 7.1, indicating a high severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by crafting a malicious URL or content that triggers the vulnerable code on the server side, which then renders unsanitized user data in the browser.