XXLPlugins

Products

Exploited and recent CVEs

• CVE-2026-0703 Medium 6.4 NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode 0.2%
• CVE-2025-68048 High 7.5 WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability 0.3%
• CVE-2026-24599 Medium 5.3 WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability 0.3%
• CVE-2025-62969 Medium 6.5 WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-52735 High 7.1 WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-10860 Medium 4.3 NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission 0.3%
• CVE-2023-47180 Medium 6.5 WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability 0.4%
• CVE-2024-30485 High 8.8 WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability 1.0%
• CVE-2024-25092 High 8.8 WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability 1.4%
• CVE-2024-32104 Medium 4.3 WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability 0.7%
• CVE-2024-32107 Medium 4.3 WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
• CVE-2024-1120 Medium 5.3 NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure 0.5%
• CVE-2023-39162 High 7.1 WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS) 0.4%