This vulnerability is an improper neutralization of input during web page generation that results in a reflected XSS flaw. A malicious payload embedded in a request can be reflected back into the rendered thank‑you page, allowing an attacker to execute arbitrary JavaScript in the victim’s browser.

The XLPlugins NextMove Lite Woo‑Thank‑You‑Page plugin for WordPress is affected in all releases from the initial release through version 2.24.0. The vulnerability is identified in versions 2.24.0 and earlier; newer releases are not affected. The plugin is available for WordPress installations.

The CVSS v3.1 base score is 7.1, indicating moderate severity. The EPSS score is below 1%, suggesting exploitation is uncommon. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a URL or form input that contains malicious JavaScript, which is reflected by the plugin when the thank‑you page is generated. Because it is a reflected XSS, an attacker needs the victim to open a crafted link or otherwise submit the payload. Based on the description, it is inferred that no authentication is required; the vulnerability can be triggered by an unauthenticated user through the public thank‑you page.