The LTL Freight Quotes suite of WordPress plugins – Freightview Edition (≤ 1.0.11), Daylight Edition (≤ 2.2.6), and Day & Ross Edition (≤ 2.1.10) – is vulnerable to a stored cross‑site scripting flaw triggered via the expiry_date parameter. The flaw arises from insufficient input sanitization and output escaping, allowing an unauthenticated attacker to embed malicious scripts that will execute whenever a user views a page where the payload is stored. While the description does not explicitly state the downstream effects, it is inferred that injected scripts could potentially lead to credential theft, session hijacking, or other malicious actions performed in the context of authenticated users.

These vulnerabilities affect the enituretechnology WordPress plugins: LTL Freight Quotes – Freightview Edition up to 1.0.11, LTL Freight Quotes – Daylight Edition up to 2.2.6, and LTL Freight Quotes – Day & Ross Edition up to 2.1.10. Administrators who have installed any of these plugin versions are potentially exposed.

The CVSS score is 7.2, indicating moderate severity, while the EPSS score is below 1 %, implying a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, but attackers could feasibly target sites with these plugins by sending crafted requests that include malicious payloads in the expiry_date parameter. Since authentication is not required, the attack surface is the public web interface of the plugin. Migrating or disabling the affected plugin or updating mitigates the risk.