CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.23.0.
AnalysisAI
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
Technical ContextAI
The vulnerability stems from improper neutralization of user-supplied input during dynamic web page generation, classified as CWE-79 (Cross-site Scripting). The NextMove Lite plugin (cpe:2.3:a:xlplugins:nextmove:*:*:*:*:lite:wordpress:*:*) is a WordPress plugin designed to customize thank-you pages for WooCommerce transactions. The flaw allows authenticated users with low privileges (PR:L per CVSS vector) to embed unescaped or unvalidated input into the thank-you page template, which is then served to subsequent visitors. Because the injected payload persists in the database or page configuration (stored XSS), all subsequent page visitors become potential victims without requiring the attacker's continued presence. The network-accessible nature (AV:N) and low attack complexity (AC:L) indicate the attack vector is straightforward HTTP requests, typical for WordPress plugin exploitation.
RemediationAI
Update XLPlugins NextMove Lite plugin to version 2.24.0 or later, which contains the fix for improper input neutralization. Users should navigate to WordPress Admin Dashboard > Plugins > Installed Plugins, locate 'NextMove Lite', and click Update if available. For organizations unable to immediately patch, restrict thank-you page editing permissions to trusted administrators only by adjusting WordPress user role capabilities. No workaround fully mitigates the stored XSS vector without patching. Refer to the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/woo-thank-you-page-nextmove-lite/vulnerability/wordpress-nextmove-lite-plugin-2-21-0-cross-site-scripting-xss-vulnerability for detailed guidance.
Share
External POC / Exploit Code
Leaving vuln.today