{"id":"CVE-2026-87780","published":"2026-10-10T06:16:43.667","lastModified":"2026-10-13T20:36:00.850","description":"The LTL Freight Quotes  WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/94448385-65df-4466-8251-d939275b6604/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stored cross-site scripting vulnerability exists in the LTL Freight Quotes WordPress plugin where unauthenticated users can inject malicious scripts into administrative pages through unsanitized input, allowing attackers to execute code in admin sessions.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and only needs an administrator to view a compromised page, with the main precondition being that the admin visits a page containing the stored XSS payload.","blast_radius":"If exploited, the vulnerability could allow attackers to hijack administrator sessions, potentially leading to full site compromise, unauthorized content changes, or data exfiltration.","remediation":"Upgrade to version 4.2.19 or later to remediate the stored XSS vulnerability in the LTL Freight Quotes plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","plugin","stored-xss"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:52:59.337Z"}}