Improper neutralization of user input in the XLPlugins NextMove Lite plugin allows attackers to store malicious scripts that are later executed in browsers of users who view the affected pages. This stored XSS flaw enables the injection of arbitrary code that runs in the context of the target website.

XLPlugins NextMove Lite versions up to and including 2.23.0 are affected. No later versions are known to contain the flaw.

The CVSS score of 6.5 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of mass exploitation at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker submitting crafted input through the plugin that is stored and subsequently rendered to other site visitors, allowing the execution of attacker‑controlled scripts.