LTL Freight Quotes EUVD-2026-96130

Exploitation requires that the vulnerable plugin version (LTL Freight Quotes before 4.2.19) be installed and that its unauthenticated submission endpoint be reachable; injection itself needs no authentication. The limiting factor is user interaction (UI:R): the stored payload only fires when a logged-in administrator subsequently views the administrative page that renders the unsanitized value, so an admin must visit the affected screen after the payload is planted. No special non-default configuration is indicated beyond having the plugin active.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) signals network-reachable, unauthenticated, low-complexity attack - consistent with the description's 'unauthenticated endpoint.' However, the C:H/I:H/A:H impact and S:U scope are questionable for a stored XSS: the payload executes only in the browser session of an administrator who later views the affected admin page (UI:R), which is better modeled as a scope change with limited direct confidentiality/integrity impact rather than full system compromise. EPSS probability is not supplied, the CVE is not listed in CISA KEV, and no proof-of-concept is confirmed in the inputs, so there is no public exploit identified at time of analysis. The real-world priority is therefore moderate rather than critical: exploitation is trivial to inject but gated on admin interaction, and no evidence of in-the-wild use exists. Conflicting signal to note explicitly: the headline CVSS of 8.8 overstates severity for a stored XSS whose worst realistic outcome is admin-session hijack, which is serious but conditional - verify the true impact scope against the WPScan advisory.

An unauthenticated attacker submits a crafted value containing a malicious script to the plugin's public endpoint, which stores it without sanitization. When a site administrator later opens the relevant admin page, the script executes in their authenticated session, enabling actions such as creating rogue admin accounts or injecting further payloads. No public proof-of-concept is confirmed, but the low attack complexity makes injection straightforward.