The VikRentItems plugin for WordPress suffers from a stored Cross-Site Scripting vulnerability in versions up to and including 1.2.1. The issue is due to inadequate sanitization of the customer email field in the booking checkout form. Specifically, the saveorder() function uses VikRequest::getString() with only sanitize_text_field(), which does not neutralize HTML attribute-breaking characters such as double quotes. Additionally, the editorder template outputs the stored customer email value into an HTML input element's value attribute without using esc_attr(), enabling injection of arbitrary web scripts. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages.

Successful exploitation can lead to execution of arbitrary scripts in the context of users accessing the injected pages, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the booking checkout form or sanitizing inputs via custom code. Monitor official vendor channels for updates and apply patches promptly once released.