Based on the description, it is inferred that the vulnerability is a reflected XSS flaw triggered by user‑supplied input. This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, allowing Reflected Cross‑Site Scripting. An attacker can embed malicious script payloads into a request to the LTL Freight Quotes – Unishippers Edition plugin, causing the script to be reflected in the generated page. When an authenticated or unauthenticated user views the manipulated page, the script executes in the victim’s browser, potentially permitting cookie theft, session hijacking, phishing or defacement of the site.

The problem affects the WordPress plugin LTL Freight Quotes – Unishippers Edition from enituretechnology, for all versions up to and including 2.5.8.

Based on the description, it is inferred that the attack vector involves crafting a malicious URL or form input containing the XSS payload, which a victim must then view to trigger the attack. The CVSS rating of 7.1 indicates a high severity, and the EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The plugin does not appear in the CISA KEV catalog, further indicating lower risk of active exploitation. Because the vulnerability is reflected, success depends on user interaction, but the impact can be severe if a compromised script is executed.