The VikRentItems Flexible Rental Management System plugin for WordPress allows an attacker to inject malicious script strings into the customer email field stored in the database. The input is only processed with sanitize_text_field(), which fails to neutralize characters that break HTML attributes, and the stored value is echoed directly into an input element’s value attribute without esc_attr(). This flaw is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79) that can execute arbitrary scripts when an affected page is viewed, potentially compromising user accounts, defacing content, or exfiltrating data. The CVSS score of 7.2 indicates a high severity with medium to high impact on security.

This vulnerability affects the VikRentItems Flexible Rental Management System WordPress plugin, versions up to and including 1.2.1. Any deployment of the described plugin version is susceptible, regardless of the WordPress core version, as the flaw resides in the plugin’s own code base.

The flaw can be exploited by unauthenticated attackers, as the vulnerable input field is accessible during the booking checkout process. Attackers can embed scripts that will run in the context of any user who visits the affected page, leading to cookie theft, session hijacking, or defacement. With a CVSS score of 7.2 and no reported exploit probability or KEV listing, the risk remains significant; however, the lack of a public exploit reduces immediate exploitation likelihood. The lack of inp‑validation combined with unsanitized output makes the attack vector straightforward once an attacker gains the ability to submit a malicious email address during checkout.