Xlplugins vulnerabilities

Products

• Nextmove 6
• Nextmove Lite 6
• Finale 5
• Finale Lite 3
• Nextmove Lite – Thank You Page For Woocommerce 3
• Finale Lite 2
• Nextmove Lite 2
• User Email Verification For Woocommerce 2

Newest

• xlplugins nextmove lite – thank you page for woocommerce NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode CVE-2026-0703 6.4 MediumMay 2, 2026
• xlplugins nextmove lite WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability CVE-2025-68048 7.5 HighFebruary 20, 2026
• xlplugins nextmove lite WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-24599 5.3 MediumJanuary 23, 2026
• xlplugins nextmove, nextmove lite +1 more WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-62969 6.5 MediumOctober 27, 2025
• xlplugins nextmove, nextmove lite +1 more WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-52735 7.1 HighOctober 22, 2025
• djeet finale lite – sales countdown timer & discount for woocommerce, xlplugins finale +1 more Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer CVE-2024-12589 6.4 MediumMarch 12, 2025
• xlplugins nextmove, nextmove lite – thank you page for woocommerce +1 more NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission CVE-2024-10860 4.3 MediumFebruary 28, 2025
• daman jeet finale lite, xlplugins finale +1 more WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability CVE-2023-47180 6.5 MediumJanuary 2, 2025
• daman jeet finale lite, xlplugins finale +1 more WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability CVE-2024-30485 Public exploit 8.8 HighJune 9, 2024
• xlplugins nextmove, nextmove lite +1 more WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability CVE-2024-25092 Public exploit 8.8 HighJune 9, 2024
• xlplugins nextmove, nextmove lite +1 more WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-32104 Public exploit 4.3 MediumApril 15, 2024
• daman jeet finale lite, xlplugins finale +1 more WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-32107 4.3 MediumApril 11, 2024
• djeet finale lite – sales countdown timer & discount for woocommerce, xlplugins finale, finale lite +3 more +5 more NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure CVE-2024-1120 5.3 MediumMarch 1, 2024
• xlplugins user email verification for woocommerce, woo-confirmation-email +1 more WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS) CVE-2023-39162 7.1 HighSeptember 4, 2023
• sandeepsoni214 user email verification for woocommerce User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass CVE-2023-2781 8.1 HighJune 2, 2023