The VikRentItems plugin for WordPress suffers from a stored cross-site scripting vulnerability in versions up to and including 1.2.1. The issue is due to improper neutralization of input during web page generation (CWE-79). Specifically, the saveorder() function stores the raw email value obtained via VikRequest::getString(), which only applies sanitize_text_field() and does not neutralize HTML attribute-breaking characters such as double quotes. The editorder template then outputs this stored value into an HTML input element's value attribute without using esc_attr(), enabling injection of arbitrary web scripts. This vulnerability can be exploited by unauthenticated attackers to execute scripts in the context of users visiting the injected page.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users accessing the injected page. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions (<=1.2.1) of the VikRentItems plugin. Applying proper input sanitization and output escaping (e.g., using esc_attr() when outputting user input in HTML attributes) is necessary to mitigate this vulnerability.