CVE-2025-5303: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2025-5303) affects multiple WordPress plugins: LTL Freight Quotes – Freightview Edition (up to 1.0.11), LTL Freight Quotes – Daylight Edition (up to 2.2.6), and LTL Freight Quotes – Day & Ross Edition (up to 2.1.10). The vulnerability was discovered by researcher sterva from Teletronics and was publicly disclosed on June 6, 2025 (Wiz Report).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that exists due to insufficient input sanitization and output escaping of the expiry_date parameter. The CVSS v3.1 base score is 7.2 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (NVD).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. The impact includes potential information disclosure and integrity compromise, as indicated by the CVSS metrics showing Low confidentiality and integrity impact (NVD, Wiz Report).

The vulnerability has a relatively high exploitability score due to its network accessibility and lack of authentication requirements. The Exploitation Probability (EPSS) is 0.1 with a probability percentile of 32.6, indicating a moderate likelihood of exploitation (Wiz Report).

A fix has been released in version 2.1.11 which includes input sanitization and output escaping for expiry_date and related fields. Users are advised to update their installations to the latest versions of the affected plugins (WordPress Plugin).