XLPlugins vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20245
3. 20254
4. 20263

Newest CVEs

• CVE-2026-0703

  NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode

  xlplugins · NextMove Lite – Thank You Page for WooCommerce

  Medium6.4
• CVE-2025-68048

  WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability

  XLPlugins · NextMove Lite

  High7.5
• CVE-2026-24599

  WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability

  XLPlugins · NextMove Lite

  Medium5.3
• CVE-2025-62969

  WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability

  XLPlugins · NextMove Lite

  Medium6.5
• CVE-2025-52735

  WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability

  XLPlugins · NextMove Lite

  High7.1
• CVE-2024-10860

  NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission

  xlplugins · NextMove Lite – Thank You Page for WooCommerce

  Medium4.3
• CVE-2023-47180

  WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability

  XLPlugins · Finale Lite

  Medium6.5
• CVE-2024-30485

  WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

  XLPlugins · Finale Lite

  High8.8
• CVE-2024-25092

  WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

  XLPlugins · NextMove Lite

  High8.8
• CVE-2024-32104

  WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability

  XLPlugins · NextMove Lite

  Medium4.3