LTL Freight Quotes CVE-2026-107160

No special configuration is required: the plugin performs no authorization check and no input sanitization before storing certain request values, so any unauthenticated remote user can submit them against a default installation of LTL Freight Quotes prior to version 4.2.19. The practical limiting factor is impact scope rather than access - injection is confined to HTML and links (not confirmed script execution per CWE-345 and C:N/I:L), the affected site must be running a vulnerable version, and the injected content only reaches visitors who view the storefront page where the stored values are rendered.

This is a moderate-severity stored HTML/link injection flaw whose signals are internally consistent and point to low real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation requiring no user interaction, which explains the SSVC 'Automatable: yes' judgment. However, impact is limited to integrity (C:N/I:L/A:N) - the attacker can inject HTML and links but there is no confidentiality or availability loss and no system-level code execution, consistent with SSVC 'Technical Impact: partial'. Crucially, SSVC 'Exploitation: none' and a very low EPSS score (0.13%, 2nd percentile) indicate no observed exploitation and low predicted probability, and the CVE is NOT on CISA KEV. Publicly available exploit code exists (WPScan), but POC availability is distinct from active exploitation. Net assessment: a genuine but low-priority issue - easy to trigger and automatable, yet low impact and no evidence of exploitation in the wild; patch during normal maintenance rather than as an emergency. No conflicting signals were identified between the CVSS vector and the description.

An unauthenticated attacker sends a crafted request to a vulnerable LTL Freight Quotes endpoint that stores user-supplied values without authorization checks or sanitization. The stored HTML and hyperlinks are then rendered to ordinary storefront visitors, enabling defacement, spam/SEO links, or social-engineering lures (e.g., phishing links). Public exploit code is available via WPScan, lowering the barrier to reproduction.