The enituretechnology LTL Freight Quotes WordPress plugins contain a stored cross-site scripting vulnerability (CWE-79) via the expiry_date parameter. This vulnerability arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to inject arbitrary scripts that execute in the context of users visiting the compromised pages. The issue affects all versions up to 1.0.11 for Freightview Edition, 2.2.6 for Daylight Edition, and 2.1.10 for Day & Ross Edition. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no known impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugins or restricting access to affected pages to trusted users only. Monitor for updates from enituretechnology regarding patches or mitigations.