CVE-2026-87780
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Risk Assessment
An unauthenticated attacker can inject a malicious script that executes in an administrator's session, enabling administrator account takeover and full control of the WordPress site.
Recommendation
Upgrade the LTL Freight Quotes plugin to version 4.2.19 or later. Check the database for injected scripts in fields stored by the plugin.
Other vulnerabilities in LTL Freight Quotes WordPress plugin
See all- CVE-2026-107160Unknown
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request. This allows unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
- CVE-2026-107158Unknown
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database. This allows unauthenticated users to modify some of the plugin's stored settings.
- CVE-2026-87781High
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Original NVD description (English source)
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS