CVE-2026-107160: LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message

Q: Who can exploit this issue?

An unauthenticated user can exploit it. The vulnerable plugin stores certain request values without authorization checks or input sanitization.

Q: What is required for injected content to affect visitors?

The injected HTML or links must be rendered in a checkout error message on the storefront. Visitors who encounter that rendered error message may be exposed to the attacker-controlled content.

Q: Are installations running version 4.2.19 affected?

The issue is described as affecting versions before 4.2.19. The provided data does not identify any affected versions at or after 4.2.19.

Published Oct 14, 2026

Updated

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.

Affected Software

1 affected component

LTL Freight Quotes – Old Dominion Edition<4.2.19

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated user can exploit it. The vulnerable plugin stores certain request values without authorization checks or input sanitization.

What is required for injected content to affect visitors?

The injected HTML or links must be rendered in a checkout error message on the storefront. Visitors who encounter that rendered error message may be exposed to the attacker-controlled content.

Are installations running version 4.2.19 affected?

The issue is described as affecting versions before 4.2.19. The provided data does not identify any affected versions at or after 4.2.19.