LTL Freight Quotes Old Dominion Edition: Unauthenticated stored XSS via shipping rules
Summary
The LTL Freight Quotes – Old Dominion Edition WordPress plugin before 4.2.19 does not sanitise or escape values submitted through an unauthenticated endpoint. These values are stored and output in an administrative page. An unauthenticated attacker can store script that runs in the session of any administrator who views the page, which can lead to a takeover of the WordPress site. Exploitation requires an administrator to view the affected page.
Affected
- LTL Freight Quotes – Old Dominion Edition versions before 4.2.19
- Lower bound of the affected range: Unknown.
Fixed in
- Version 4.2.19
- Vendor advisory: Unknown.
Workaround
- No vendor workaround known.
- If an update is not possible immediately, restrict access to the plugin's admin pages and review stored plugin settings and shipping rule entries for injected script.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Public proof of concept: Unknown (not confirmed).
Our recommendation
- Update LTL Freight Quotes – Old Dominion Edition to version 4.2.19 or later.
- If an update is not immediately possible, restrict access to the plugin's admin pages.
- Review stored plugin settings and shipping rule entries for injected script, and check administrator accounts for unexpected changes.
- Check whether any WooCommerce site uses this edition, especially for US shipping. Sites without this plugin are not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: LTL Freight Quotes – Old Dominion Edition < 4.2.19 – Unauthenticated Stored XSS via Shipping Rules wpscan.com
- Patchstack: LTL Freight Quotes – Old Dominion Edition vulnerabilities patchstack.com
- VulDB: CVE-2026-87780 vuldb.com
- OpenCVE: CVE-2026-87780 app.opencve.io
- CVE Threat Intelligence: CVE-2026-87780 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:47.
Original description (NVD)
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.