CVE-2025-26918 Cross-site scripting in Small Package Quotes – Unishippers Edition

What is CVE-2025-26918?

CVE-2025-26918 is a high-severity cross-site scripting vulnerability in enituretechnology Small Package Quotes – Unishippers Edition, published on 3 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Reflected XSS.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.

Weakness: CWE-79

Which versions are affected by CVE-2025-26918?

It affects 1 product.

Products include Eniture Small Package Quotes.

How do I fix CVE-2025-26918?

No fix has been published for CVE-2025-26918 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-26918 being exploited?

There is no known exploitation of CVE-2025-26918 in the wild and no public exploit code.

Other vulnerabilities in enituretechnology Small Package Quotes – Unishippers Edition

• CVE-2024-13491 Small Package Quotes – For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injection High 7.5
• CVE-2024-13533 Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injection High 7.5
• CVE-2024-13534 Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection High 7.5
• CVE-2024-13475 Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection High 7.5
• CVE-2024-13532 Small Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h35h-f387-6vv4.