What is the CVSS score of CVE-2026-0703?

CVE-2026-0703 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

NextMove Lite Thank You Page CVE-2026-0703

EUVD-2026-26788 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 14:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 13:30 euvd

EUVD-2026-26788

Analysis Generated

May 02, 2026 - 13:30 vuln.today

CVE Published

May 02, 2026 - 13:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The NextMove Lite - Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in NextMove Lite - Thank You Page for WooCommerce plugin allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'xlwcty_current_date' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browser of any user viewing affected pages, potentially compromising WordPress site integrity and user sessions. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exists in the 'xlwcty_current_date' shortcode implementation (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin fails to properly sanitize shortcode attributes before processing and fails to escape output when rendering user-supplied data on the page. This allows authenticated users to embed malicious scripts within shortcode parameters, which are then stored in the WordPress database and executed client-side whenever the page is loaded. The affected WordPress plugin (CPE: cpe:2.3:a:xlplugins:nextmove_lite_-_thank_you_page_for_woocommerce) uses shortcode merge tags to customize thank-you pages for WooCommerce, creating an attack surface where insufficiently validated attributes are reflected into the page markup.

RemediationAI

Upgrade to the patched version released after 2.23.0 as soon as it becomes available via WordPress plugin dashboard or direct download from the WordPress.org plugin repository. Before patching, implement temporary mitigation by restricting contributor-level access to only trusted editors by reviewing user roles in WordPress Settings > Users and downgrading unnecessary contributor accounts to subscriber or author roles where feasible. Disable the 'xlwcty_current_date' shortcode temporarily if not in active use by adding a filter to wp-config.php or a must-use plugin, though this may affect page functionality. Monitor audit logs for any suspicious contributor activity, particularly shortcode usage in pages. The WordPress plugin changelog (referenced in the CVE changeset 3482613) will provide specific fix version details once released.