# CVE-2026-116548: VikRentCar stored cross-site scripting via optionals parameter

Source: https://junglewise.ai/threats/cve-2026-116548-the-vikrentcar-car-rental-management-system-plugin-for-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-116548 · Severity: high · CVSS 7.2 · Published 2026-10-31

The VikRentCar plugin is a car rental management system for WordPress used by businesses to manage vehicle bookings and rentals. An unauthenticated attacker can inject malicious scripts into rental listings through the optionals parameter, and these scripts execute in the browsers of any customer or employee who views the affected page, potentially allowing theft of session credentials or redirection to phishing sites.

Technologies: [VikRentCar Car Rental Management System](https://junglewise.ai/threats/technologies/vikrentcar-car-rental-management-system). Vendors: [VikRentCar](https://junglewise.ai/threats/vendors/vikrentcar).

## Quick answers

**Is CVE-2026-116548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116548 being exploited in the wild.

**How severe is CVE-2026-116548?** High severity, with a CVSS score of 7.2, published 31 October 2026.

**Which products and versions are affected?** VikRentCar Car Rental Management System up to 1.4.10.

**Is there a fix for CVE-2026-116548?** Yes: fixed in 1.4.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116548 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116548?** Check whether you run VikRentCar Car Rental Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.11

## Technical details

Stored XSS vulnerability in the VikRentCar plugin due to insufficient input sanitization and output escaping of the optionals parameter. The vulnerability is accessible to unauthenticated attackers and persists in the database, executing whenever users access the injected page. Fixed in version 1.4.11.

## Affected products

- VikRentCar Car Rental Management System up to 1.4.10

## Timeline

- 2026-10-31: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/admin/views/editbusy/tmpl/default.php](https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/admin/views/editbusy/tmpl/default.php)
- [https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php](https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php)

## Related threats

- [VikRentCar Car Rental Management System SQL injection via catid parameter](https://junglewise.ai/threats/cve-2026-116750-the-vikrentcar-car-rental-management-system-plugin-for-wordpress)
- [VikRentCar Car Rental Management System CSRF leading to RCE](https://junglewise.ai/threats/cve-2026-111120-the-vikrentcar-car-rental-management-system-plugin-for-wordpress)