Unauthenticated Cross Site Scripting is present in VikRentCar plugin versions up to 1.4.10 because the plugin does not properly escape or validate data before outputting it into the page. An attacker can supply malicious script fragments that are reflected or stored, which will execute in the browser of any visitor to the affected site. The resulting impact includes defacement of the website, theft of user session data or credentials, and other client‑side compromise activities.

WordPress plugin VikRentCar by e4jvikwp, any installation running version 1.4.10 or earlier.

The CVSS score of 7.1 indicates a high risk to confidentiality and integrity for an unauthenticated web user. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the attack vector is an unauthenticated HTTP request, meaning any visitor could exploit the flaw. Consequently, the risk remains moderate to high until the plugin is updated.