CVE-2026-107160: Unknown Ltl Freight Quotes

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.

Affected products

• Unknown Ltl Freight Quotes: before 4.2.19 (fixed in 4.2.19)

Published 2026-10-14. Last modified 2026-10-14.