What is the CVSS score of CVE-2025-62969?

CVE-2025-62969 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-62969

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-27 audit@patchstack.com

WordPress PHP XSS Nextmove

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.23.0.

AnalysisAI

Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input during dynamic web page generation, classified as CWE-79 (Cross-site Scripting). The NextMove Lite plugin (cpe:2.3:a:xlplugins:nextmove:*:*:*:*:lite:wordpress:*:*) is a WordPress plugin designed to customize thank-you pages for WooCommerce transactions. The flaw allows authenticated users with low privileges (PR:L per CVSS vector) to embed unescaped or unvalidated input into the thank-you page template, which is then served to subsequent visitors. Because the injected payload persists in the database or page configuration (stored XSS), all subsequent page visitors become potential victims without requiring the attacker's continued presence. The network-accessible nature (AV:N) and low attack complexity (AC:L) indicate the attack vector is straightforward HTTP requests, typical for WordPress plugin exploitation.

RemediationAI

Update XLPlugins NextMove Lite plugin to version 2.24.0 or later, which contains the fix for improper input neutralization. Users should navigate to WordPress Admin Dashboard > Plugins > Installed Plugins, locate 'NextMove Lite', and click Update if available. For organizations unable to immediately patch, restrict thank-you page editing permissions to trusted administrators only by adjusting WordPress user role capabilities. No workaround fully mitigates the stored XSS vector without patching. Refer to the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/woo-thank-you-page-nextmove-lite/vulnerability/wordpress-nextmove-lite-plugin-2-21-0-cross-site-scripting-xss-vulnerability for detailed guidance.