The vulnerability is a reflected cross‑site scripting flaw present in the VikRentCar plugin for WordPress. Versions up to and including 1.4.7 contain an input path that does not neutralize script tags, enabling attackers to inject malicious code that executes in the browsers of site visitors without any authentication. The weakness is classified as CWE‑79.

The affected system is the WordPress plugin VikRentCar by e4jvikwp, specifically all releases with a version number of 1.4.7 or earlier. Users running these versions are vulnerable, regardless of authentication level, as the flaw is exploitable without credentials.

The CVSS score for this issue is 7.1, indicating a moderate severity. The EPSS score is < 1%, indicating a low likelihood of exploitation, and the lack of an existing KEV listing suggests no confirmed widespread attacks yet. The attacker can execute the exploit via the web interface that accepts user input, inferred from the nature of reflected XSS, so sites that expose the plugin publicly are at risk.