Xlplugins

14 CVEs across 7 Xlplugins products. Browse Xlplugins vulnerabilities, severities, and proof-of-concept exploits.

Xlplugins products with known CVEs

ProductCVEs
Nextmove6
Nextmove Lite6
Finale5
Finale Lite3
Nextmove Lite – Thank You Page For Woocommerce3
User Email Verification For Woocommerce1
Woo-Confirmation-Email1
Xlplugins CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-0703Medium6.42026-05-02The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' sho…
CVE-2025-68048High7.52026-02-20Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Securit…
CVE-2026-24599Medium5.32026-01-23Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Config…
CVE-2025-62969Medium6.52025-10-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite…
CVE-2025-52735High7.12025-10-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite…
CVE-2024-12589Medium6.42025-03-12The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdow…
CVE-2024-10860Medium4.32025-02-28The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on t…
CVE-2023-47180Medium6.52025-01-02Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale…
CVE-2024-30485High8.82024-06-09Missing Authorization vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.
CVE-2024-25092High8.82024-06-09Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.
CVE-2024-32104Medium4.32024-04-15Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.18.1.
CVE-2024-32107Medium4.32024-04-11Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.
CVE-2024-1120Medium5.32024-03-01The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to u…
CVE-2023-39162High7.12023-09-04Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XLPlugins User Email Verification for WooCommerce plugin <= 3.5.0 versions.