CVE-2026-87780

Summary

A stored cross-site scripting vulnerability exists in the LTL Freight Quotes WordPress plugin where unauthenticated users can inject malicious scripts into administrative pages through unsanitized input, allowing attackers to execute code in admin sessions.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and only needs an administrator to view a compromised page, with the main precondition being that the admin visits a page containing the stored XSS payload.

Blast radius

If exploited, the vulnerability could allow attackers to hijack administrator sessions, potentially leading to full site compromise, unauthorized content changes, or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.2.19 or later to remediate the stored XSS vulnerability in the LTL Freight Quotes plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.