Xlplugins

CVE-2026-0703 May 02, 13:26 MEDIUM This Month

Stored cross-site scripting in NextMove Lite - Thank You Page for WooCommerce plugin allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'xlwcty_current_date' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browser of any user viewing affected pages, potentially compromising WordPress site integrity and user sessions. No public exploit code or active exploitation has been confirmed at the time of analysis.

CVE-2025-62969 Oct 27, 02:15 MEDIUM This Month

Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.

CVE-2025-52735 Oct 22, 15:15 HIGH This Week

Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.

CVE-2024-12589 Mar 12, 07:15 MEDIUM PATCH This Month

The Finale Lite - Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdown timer in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-10860 Feb 28, 10:15 MEDIUM This Month

The NextMove Lite - Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on the _submit_uninstall_reason_action(). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-47180 Jan 02, 12:15 MEDIUM This Month

Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.16.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-30485 Jun 09, 11:15 HIGH This Week

Missing Authorization vulnerability in XLPlugins Finale Lite.18.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-25092 Jun 09, 11:15 HIGH This Week

Missing Authorization vulnerability in XLPlugins NextMove Lite.17.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-32104 Apr 15, 09:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins NextMove Lite.18.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 15.1% and no vendor patch available.

CVE-2024-32107 Apr 11, 13:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins Finale Lite.18.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-1120 Mar 01, 10:15 MEDIUM PATCH This Month

The NextMove Lite - Thank You Page for WooCommerce and Finale Lite - Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2023-39162 Sep 04, 10:15 MEDIUM This Month

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.