Vulnerabilities

TI-2025-04777 CVE-2025-5322 · GHSA-cgqm-vxrq-vp47

VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload

LOW 35

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and includin…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00757 Published 2025-07-03 No fix listed CWE-434

TI-2025-29003 CVE-2025-46251 · GHSA-mprw-38c7-fpfv

WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants: from n/a through <= 1.3.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00156 Published 2025-04-22 No fix listed CWE-352

TI-2024-10786 CVE-2024-11640 · GHSA-h6wp-q54c-qp95

Cross-site request forgery in e4jvikwp VikRentCar Car Rental Management System

MEDIUM 40

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00329 Published 2025-03-08 No fix listed CWE-352

TI-2024-26577 CVE-2024-39653 · GHSA-mpm3-6hq8-5x2v

WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability

MEDIUM 48

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00458 Published 2024-08-29 No fix listed CWE-89

TI-2024-01717 CVE-2024-1845 · GHSA-cgcx-7m9m-3qhm

VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery

HIGH 73

The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00286 Published 2024-07-11 Fixed in 1.3.2 CWE-352

TI-2023-09785 CVE-2023-23998 · GHSA-gh28-pvv9-7gff

WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00392 Published 2023-04-06 No fix listed CWE-79