Stored XSS in WordPress LTL Freight Quotes Plugin

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The LTL Freight Quotes WordPress plugin before version 4.2.19 contains a critical stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript code through an unprotected endpoint. The vulnerability stems from inadequate input sanitization and output escaping, enabling attackers to store malicious payloads in the application database. When administrators access the affected page, the injected code executes within their authenticated session, potentially allowing attackers to steal session tokens, modify content, create new admin accounts, or deploy further compromise. Any WordPress site running this plugin version is vulnerable, and the attack requires no authentication, making it particularly dangerous for exposed instances.

Casky's 323 mapped security skills detect this vulnerability pattern by analyzing attack chains across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify detection signals including: (1) unauthenticated POST/GET requests to admin-level endpoints lacking access controls, (2) input containing unescaped HTML/JavaScript entities being stored without sanitization checks, and (3) administrative interface outputs rendering user-supplied data without proper context-aware encoding. Claude's extended reasoning capabilities would correlate these signals to recognize the stored XSS attack pattern, flag the CWE-79 weakness in real-time, and provide practitioners with specific remediation guidance tied to secure coding practices—such as implementing nonce verification, using WordPress sanitization functions like `sanitize_text_field()`, and applying escaping functions like `esc_html()` or `wp_kses_post()` on output.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87780.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-87780

Casky has 323 skills that investigate the attack patterns behind CVE-2026-87780. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn