The LTL Freight Quotes WordPress plugin prior to version 4.2.19 stores data from a request without performing authorization checks or input sanitization, which allows an unauthenticated user to inject arbitrary HTML and links. Those injected elements are subsequently rendered to any visitor of the storefront, resulting in a stored HTML injection flaw. This flaw is classified as a stored cross‑site scripting vulnerability, meaning that malicious content could be delivered to all users who view the affected page.

The vulnerability affects installations of the LTL Freight Quotes plugin for WordPress with versions older than 4.2.19. No specific manufacturer identification is available beyond the product name, so any WordPress site that has not upgraded the plugin remains at risk.

Based on the description, it is inferred that an unauthenticated user can send an HTTP request to the plugin that stores arbitrary HTML content. The vulnerability is rated at CVSS 5.3, indicating moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in KEV, suggesting a low yet existing chance of exploitation. When arbitrary payloads are stored, they are rendered to all visitors of the storefront, potentially enabling client‑side script execution, defacement, or theft of session data.