CVE-2025-5303: WordPress LTL Freight Quotes XSS Flaw

CVE-2025-5303 Overview

CVE-2025-5303 is a stored Cross-Site Scripting (XSS) vulnerability affecting three related WordPress plugins: LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition, and LTL Freight Quotes – Day & Ross Edition. The flaw resides in the expiry_date parameter, which fails to enforce input sanitization and output escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any user who visits an affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated remote attackers can persist malicious scripts that execute against site visitors and administrators, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

LTL Freight Quotes – Freightview Edition (versions up to and including 1.0.11)
LTL Freight Quotes – Daylight Edition (versions up to and including 2.2.6)
LTL Freight Quotes – Day & Ross Edition (versions up to and including 2.1.10)

Discovery Timeline

2025-06-07 - CVE-2025-5303 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5303

Vulnerability Analysis

The three LTL Freight Quotes plugins accept the expiry_date parameter without performing proper sanitization on input or escaping on output. The plugins render the parameter value directly into HTML pages generated by the WordPress site. An attacker supplies a payload containing JavaScript, and the plugin stores it in the database. When any user subsequently loads a page that renders the stored value, the browser executes the attacker's script in the context of the WordPress origin.

Stored XSS in WordPress plugins frequently leads to administrative account compromise. Scripts executing in an administrator session can create new privileged users, inject persistent backdoors via theme or plugin editors, or pivot to broader site takeover. The EPSS score of 0.98% reflects observed exploitation interest in WordPress XSS issues of this class.

Root Cause

The plugins read the expiry_date request parameter and output it back into HTML responses without invoking WordPress sanitization helpers such as sanitize_text_field() on input or esc_html()/esc_attr() on output. Source review of files such as en-hit-to-update-plan.php and common/en-plans.php shows direct echoing of user-supplied values into the rendered page.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond a victim loading an injected page. An attacker submits a crafted request containing a JavaScript payload in the expiry_date parameter to an endpoint exposed by any of the three affected plugins. The payload is persisted and served to subsequent visitors, including site administrators.

// Code example not available - see referenced source files
// for the unescaped output sinks at en-hit-to-update-plan.php#L29
// and common/en-plans.php#L110

Reference the WordPress Plugin Source Code for the Freightview edition and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-5303

Indicators of Compromise

Unexpected <script>, onerror=, or onload= substrings stored in WordPress database tables tied to the affected plugins.
HTTP POST or GET requests containing encoded JavaScript payloads in the expiry_date parameter.
New or unrecognized WordPress administrator accounts created shortly after suspicious requests to plugin endpoints.
Outbound browser requests from authenticated admin sessions to unfamiliar external domains.

Detection Strategies

Inspect web server access logs for requests targeting en-hit-to-update-plan.php or en-plans.php that include expiry_date parameters with HTML or script syntax.
Query the WordPress database for plugin-managed rows containing <, >, or javascript: tokens in expiry_date fields.
Deploy Web Application Firewall (WAF) rules that block XSS payload patterns submitted to the affected plugin endpoints.

Monitoring Recommendations

Alert on creation of new WordPress users with administrator or editor roles outside normal change windows.
Monitor for modifications to plugin and theme files via file integrity monitoring.
Track browser-side execution anomalies on admin pages, such as unexpected XHR or fetch calls to external hosts.

How to Mitigate CVE-2025-5303

Immediate Actions Required

Upgrade each affected plugin to a version released after 1.0.11 (Freightview), 2.2.6 (Daylight), and 2.1.10 (Day & Ross).
Audit existing plugin data for stored payloads and remove any records containing script content from the expiry_date field.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Review recent administrative actions, including user creation and plugin or theme edits.

Patch Information

Review the Wordfence Vulnerability Report for current patched version information. If a vendor patch is not yet available for a given edition, deactivate and remove the plugin until a fixed release is published.

Workarounds

Disable the affected plugin until an updated version is installed.
Restrict access to plugin administrative endpoints using server-level allow lists or authentication gateways.
Apply a WAF rule that strips or rejects HTML and script characters in the expiry_date parameter on requests to the plugin paths.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on pages rendered by the affected plugins.

bash

# Example WAF rule (ModSecurity) to block script content in expiry_date
SecRule ARGS:expiry_date "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1005303,phase:2,deny,status:403,log,msg:'CVE-2025-5303 XSS attempt in expiry_date'"