CVE-2026-87780: LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using versions earlier than 4.2.19 are exposed. An attacker does not need to authenticate, but the stored script executes only when an administrator views the affected administrative page.
What access does an attacker need?
The attacker only needs access to the plugin's unauthenticated endpoint used to submit shipping-rule values. No WordPress account is required.
How can I reduce risk if I cannot update immediately?
Restrict or disable access to the unauthenticated endpoint that accepts shipping-rule submissions, if operationally feasible. Administrators should avoid viewing affected shipping-rule data until the issue is remediated.