95 matches found
CVE-2024-25092
CVE-2024-25092 NextMove Lite 2.18.0 - 订阅者及以上任意插件安装/激活 描述： NextMove Lite – WooCommerce 感谢页插件 for WordPress 存在因缺少对 'xladdoninstallation' 函数的能力检查而导致的数据未授权修改漏洞，影响版本直至 2.17.0（含）。该漏洞使得经过身份验证的攻击者（具有订阅者及以上权限）能够安装并激活任意插件。 Severity: medium CVE ID: CVE-2024-25092 CVSS Score: 6.5 CVSS Metrics:...
CVE-2024-25092
CVE-2024-25092 漏洞利用 概述 CVE-2024-25092 是一个影响 WordPress NextMove Lite 插件（版本 = 2.17.0）的高严重性漏洞。该漏洞允许订阅者级别及以上的用户在 WordPress 站点上安装和激活任意插件，原因是缺少授权检查。 详情 发布日期 : 2024-06-09 更新日期 : 2024-06-09 严重性 : 高 CVSS 分数: 8.8 CWE : CWE-862 - 缺少授权 受影响版本 : 从 n/a 到 2.17.0 的所有版本 CVSS 向量 CVSS 版本 : 3.1 向量字符串 :...
WordPress NextMove Lite plugin <= 2.24.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin NextMove Lite versions = 2.24.0...
CVE-2026-0703
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...
EUVD-2026-26788
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-0703 NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-0703 NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-0703
Affected software: NextMove Lite – Thank You Page for WooCommerce plugin for WordPress. Vulnerability: Stored Cross-Site Scripting via the plugin’s** 'xlwcty_current_date' shortcode. Root cause: insufficient input sanitization and output escaping on user-supplied attributes. Versions impacted: al...
CVE-2026-0703: Improper Neutralization of Input During Web Page Generation
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...
WordPress plugin NextMove Lite – Thank You Page for WooCommerce 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
WordPress NextMove Lite – Thank You Page for WooCommerce plugin <= 2.23.0 - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Thank You Page for WooCommerce plugin = 2.23.0 - Thank You Page for WooCommerce = 2.23.0 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin NextMove Lite versions = 2.23.0...
CVE-2025-68048
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...
CVE-2025-68048
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...
CVE-2025-68048 WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...
CVE-2025-68048 WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...
CVE-2025-68048
CVE-2025-68048 involves the WordPress plugin NextMove Lite (XLPlugins)
WordPress plugin NextMove Lite 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
CVE-2025-68048: Missing Authorization
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...
PT-2026-21082
Name of the Vulnerable Software and Affected Versions XLPlugins NextMove Lite versions through 2.23.0 Description An issue exists in XLPlugins NextMove Lite related to incorrectly configured access control security levels, allowing for missing authorization. This allows exploitation of the system...