CVE-2025-5303
BaseFortify
Publication date: 2025-06-07
Last updated on: 2025-06-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in certain WordPress plugins related to LTL Freight Quotes. It occurs because the plugins do not properly sanitize or escape the 'expiry_date' parameter, allowing unauthenticated attackers to inject malicious scripts. These scripts are then stored and executed whenever a user accesses the affected page.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute arbitrary scripts in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions without requiring authentication, potentially compromising user data and site integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation uses any of the affected LTL Freight Quotes plugins (Freightview Edition up to 1.0.11, Daylight Edition up to 2.2.6, or Day & Ross Edition up to 2.1.10). To confirm, you can inspect the plugin versions installed. Additionally, you can look for stored XSS payloads in pages that use the expiry_date parameter by reviewing the database or web pages for suspicious script tags or encoded scripts. There are no specific commands provided in the resources for detection.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the affected plugins to versions that include the security fix. For example, updating the 'ltl-freight-quotes-day-ross-edition' plugin to version 2.1.11 or later, which includes input sanitization and output escaping for the expiry_date parameter, will prevent exploitation. Ensuring that all affected plugins are updated to their patched versions is critical. [1]