What’s Vulnerable › Products

XLPlugins NextMove Lite vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your XLPlugins NextMove Lite version is affected

Latest XLPlugins NextMove Lite vulnerabilities

• CVE-2026-0703 — NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode (CVSS 6.4)
• CVE-2025-68048 — WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-24599 — WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
• CVE-2025-62969 — WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-52735 — WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2024-10860 — NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission (CVSS 4.3)
• CVE-2024-25092 — WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability (CVSS 8.8)
• CVE-2024-32104 — WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
• CVE-2024-1120 — NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure (CVSS 5.3)