cleantalk
Vulnerabilities and Security Researches

NextMove Lite – Thank You Page for WooCommerce, CVE-2026-0703

CVE, Research URL

CVE-2026-0703

Home page URL

Security reports for NextMove Lite – Thank You Page for WooCommerce

Application

NextMove Lite – Thank You Page for WooCommerce

Published on
May 02, 2026
Research Description
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
max 2.24.0.
Status
vulnerable
Previous vulnerability researches
Page Builder: Pagelayer – Drag and Drop website builder (CVE-2025-24573) , Jan 26, 2025
Page Builder: Pagelayer – Drag and Drop website builder (CVE-2025-1926) , Mar 10, 2025
Page Builder: Pagelayer – Drag and Drop website builder (CVE-2024-13427) , May 25, 2025
Page Builder: Pagelayer – Drag and Drop website builder (CVE-2025-4223) , May 25, 2025
Page Builder: Pagelayer – Drag and Drop website builder (CVE-2025-2104) , Mar 14, 2025
New vulnerability
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2026-4100) , May 04, 2026
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup (CVE-2026-7649) , May 04, 2026
FundPress – WordPress Donation Plugin (CVE-2026-4650) , May 04, 2026
Import and export users and customers (CVE-2026-7641) , May 04, 2026
NextMove Lite – Thank You Page for WooCommerce (CVE-2026-0703) , May 04, 2026