Read the docs
TI-2021-06680 Aliases CVE-2021-24388GHSA-cw42-gp9m-qx5j

Vik Rent Car < 1.1.7 - CSRF to Stored XSS

Priority LOW 24CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.

Summary

In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.

Why it matters now

EPSS 0.00319 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed VikRentCar Car Rental Management System (E4J s.r.l.): 1.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
E4J s.r.l.VikRentCar Car Rental Management System1.1.7 to before 1.1.71.1.7Patch availableCNA
  • VikRentCar Car Rental Management System VendorE4J s.r.l. Affected 1.1.7 to before 1.1.7 Fixed in 1.1.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:e4j:vikrentcar_car_rental_management_system:*:*:*:*:*:wordpress:*:*before 1.1.7VulnerableE4j
  • cpe:2.3:a:e4j:vikrentcar_car_rental_management_system:*:*:*:*:*:wordpress:*:* Versions before 1.1.7 Vulnerable ·E4j

Remediation

  • Fix · CNA VikRentCar Car Rental Management System (E4J s.r.l.) Fixed in 1.1.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24388
  2. 2026-10-03 Alias added: GHSA-cw42-gp9m-qx5j

References

Exploit 1

  • TI-2024-21654 WordPress VikRentCar Car Rental Management System plugin <= 1.3.2 - Sensitive Data Exposure via Invoices vulnerability CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences