Threats tagged 'ghsa-9wp3-78x4-p2p5'

The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'poplink' parameter affecting all versions up to and including 1.4.9. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires a WordPress nonce token (vikwp_nonce), which the plugin exposes to unauthenticated visitors on the public booking-confirmation page, enabling attackers to obtain a valid token without authentication.