High severity · published Oct 10, 2026
CVE-2026-87780
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LF
LTL Freight Quotes ·
before 4.2.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87780
exploit
https://wpscan.com/vulnerability/94448385-65df-4466-8251-d939275b6604/
More from LTL Freight Quotes
8.6
CVE-2026-87781
LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter
5.3
CVE-2026-107160
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
5.3
CVE-2026-107158
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route