CVE-2026-87780: CWE-79 Cross-Site Scripting (XSS) in LTL Freight Quotes

The LTL Freight Quotes WordPress plugin prior to version 4.2.19 contains a stored XSS vulnerability (CWE-79). Specifically, values submitted via an unauthenticated endpoint are not properly sanitized or escaped before being stored and displayed in an administrative interface. This flaw enables an attacker to inject malicious scripts that execute in the session of administrators who view the affected page, potentially leading to session hijacking or other administrative-level impacts.

Successful exploitation results in stored cross-site scripting that executes in the context of an administrator's session. This can lead to unauthorized actions performed with administrator privileges, including session hijacking, data theft, or manipulation of plugin or site settings. The vulnerability affects only administrators who view the malicious input, not general users.

Upgrade the LTL Freight Quotes plugin to version 4.2.19 or later, where this vulnerability is fixed. Since no patch links are provided, verify the availability of the update from the official plugin repository or vendor. Until patched, restrict access to the administrative interface and avoid interacting with untrusted input submitted through the vulnerable endpoint.