CVE-2026-16143

Summary

The flaw allows unauthenticated attackers to inject arbitrary scripts via the customer email field in the booking checkout form due to insufficient input sanitization and output escaping.

Exploitability

Exploitation is relatively easy as it requires control over the customer email input, which can be achieved through social engineering or by manipulating user inputs.

Blast radius

If exploited, attackers could inject malicious scripts that execute in users' browsers, potentially leading to data theft or further attacks.

Prioritized remediation

Update to a patched version of VikRentItems plugin if available; otherwise, sanitize and escape all input fields thoroughly before storing or displaying them.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.