CVE-2026-16143

Name of the Vulnerable Software and Affected Versions VikRentItems – Flexible Rental Management System versions prior to 1.2.2

Description Stored Cross-Site Scripting occurs via the customer email field of the booking checkout form. The issue stems from insufficient input sanitization and output escaping in the saveorder() function, which uses VikRequest::getString() and sanitize text field() but fails to neutralize HTML attribute-breaking characters like double quotes. Additionally, the editorder template echoes the stored custmail variable into an HTML input element's value attribute without using esc attr(). This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update VikRentItems – Flexible Rental Management System to version 1.2.2 or later.