CVE-2026-107160

Deferred Deferred - Pending Action

Unauthenticated HTML Injection in LTL Freight Quotes WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107160

EUVD

EUVD-2026-100888

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	LTL	Freight Quotes 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated stored HTML injection in the LTL Freight Quotes WordPress plugin versions below 4.2.19. It allows attackers to inject malicious HTML or links into checkout error messages without needing authentication. These injected elements are then displayed to visitors on the storefront.

Detection Guidance

Check if the LTL Freight Quotes WordPress plugin version is below 4.2.19. Inspect WordPress admin panel for plugin updates or use WP-CLI command: wp plugin list --name='LTL Freight Quotes' to verify version.

Impact Analysis

Unauthenticated users could inject malicious HTML or links that appear on your storefront. This could lead to phishing attacks, defacement, or spreading malware to your visitors. The vulnerability may also damage your site's reputation and trustworthiness.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthenticated users to inject malicious HTML or links into the storefront. If exploited, it may lead to unauthorized data collection or phishing attacks, which could violate user privacy and data protection requirements under these regulations.

Mitigation Strategies

Update the LTL Freight Quotes plugin to version 4.2.19 or later immediately. Remove or disable the plugin if updates are not available. Monitor for suspicious HTML injections in storefront content.

Hi! I’m here to help you understand CVE-2026-107160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70