CVE WATCH / VULNERABILITY DETAIL
CVE-2026-111120
HIGHCVSS 8.8NVD feed
Published 28 October 2026 · tracked since 29 October 2026
Description
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2025-30414 HIGH 7.1
- CVE-2026-92797 HIGH 8.8
- CVE-2026-101935 MEDIUM 6.1
- CVE-2026-76780 MEDIUM 6.3
- CVE-2026-77188 MEDIUM 6.4
- CVE-2026-77871 MEDIUM 6.4
- CVE-2026-92098 MEDIUM 6.1
- CVE-2026-76005 MEDIUM 6.5
- CVE-2026-118164 MEDIUM 6.4
- CVE-2026-116609 MEDIUM 6.5