CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
Explanation of Vulnerability in Simple Terms
The LTL Freight Quotes – Unishippers Edition plugin contains a cross-site scripting (XSS) vulnerability in versions up to 2.5.8. An attacker can inject malicious scripts that execute in the browsers of site visitors, potentially stealing session data or performing actions on their behalf. The vulnerability requires user interaction—typically clicking a malicious link—and affects the broader site scope beyond the plugin itself.
What an attacker can do
Inject malicious scripts that run in visitors' browsers to steal data or perform unauthorized actions.
Potential impact on your site
Visitors' sessions and data are at risk; attackers can deface content or redirect users to phishing sites.
Conditions required to exploit
Attacker crafts a malicious link; a site visitor must click it or visit a compromised page.
Key dates
External resources
Related vulnerabilities
