What’s Vulnerable › Vulnerabilities
CVE-2026-107160: LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-14
- Weakness: CWE-345
Description
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
Affected products
- LTL Freight Quotes: before 4.2.19 — fixed in 4.2.19
How to fix
Upgrade to a fixed version: LTL Freight Quotes 4.2.19. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-107160 or the next vulnerability affects your stack