Is CVE-2026-112835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112835 being exploited in the wild.

How severe is CVE-2026-112835?

High severity, with a CVSS score of 7.1, published 23 October 2026.

Which products and versions are affected?

E4jvikwp VikRentCar through 1.4.8.

Is there a fix for CVE-2026-112835?

Yes: fixed in 1.4.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112835 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112835?

Check whether you run E4jvikwp VikRentCar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112835: e4jvikwp VikRentCar reflected cross-site scripting

CVE-2026-112835 · Severity: high · CVSS 7.1 · Published 2026-10-23

VikRentCar is a WordPress plugin that manages car rental bookings and reservations. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially stealing visitor data or hijacking their accounts. An attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in their browser within the context of the rental site.

Technologies: E4jvikwp VikRentCar. Vendors: E4jvikwp.

Quick answers

Is CVE-2026-112835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112835 being exploited in the wild.
How severe is CVE-2026-112835?: High severity, with a CVSS score of 7.1, published 23 October 2026.
Which products and versions are affected?: E4jvikwp VikRentCar through 1.4.8.
Is there a fix for CVE-2026-112835?: Yes: fixed in 1.4.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112835 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112835?: Check whether you run E4jvikwp VikRentCar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.9

Technical details

The plugin fails to properly neutralize user-supplied input during web page generation, allowing reflected XSS attacks. The vulnerability is unauthenticated but requires user interaction (e.g., clicking a malicious link). Successful exploitation allows an attacker to steal session cookies, perform actions on behalf of the victim, or redirect users to phishing pages.

Affected products

e4jvikwp VikRentCar through 1.4.8

Timeline

2026-10-21: disclosed
2026-10-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.