CVE-2026-107160: medium-severity vulnerability in LTL Freight Quotes
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.1%
exploitation probability
0.1%top 98% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · LTL Freight Quotespublic PoCs found — 1
cve_referencewpscan.com/vulnerability/2672da6c-f494-4449-90fd-fb1c2dd78235/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — LTL Freight Quotes
In the same product, most dangerous first.
CVE-2026-87781HIGHLTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' ParameterEPSS 0.3%CVE-2026-87780HIGHLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping RulesEPSS 0.2%CVE-2026-107158MEDIUMLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST RouteEPSS 0.2%