The vulnerability allows an authenticated user with contributor or higher role to insert a malicious script into the "className" attribute of a widget block. The script is stored in the database and rendered when any visitor loads a page containing the affected widget. Because the payload is executed client‑side, an attacker can steal cookies, hijack sessions, deface content, or redirect users to phishing sites. The weakness arises from inadequate input filtering and output escaping, specifically the use of wp_kses_post() at save time which does not neutralize an attribute injection context. The injected payload only requires a single double‑quote to break out of the attribute, and the comment encoding is reversed during rendering, trivially enabling execution.

WordPress sites running the VikRentCar Car Rental Management System plugin, versions 1.4.10 and earlier, are affected.

The CVSS v3.1 score of 6.4 indicates a moderate severity and the absence of an EPSS score suggests either limited data or low current exploitation activity. The vulnerability does not appear in the CISA KEV catalog, implying no confirmed widespread attacks. Nevertheless, because it requires only contributor access—levels normally granted for content editors—the plugin exposes a significant attack surface. An attacker must achieve contributor or higher privileges, but once that is granted, the stored XSS can be executed in every user who visits the injected page.