The NextMove Lite – Thank You Page for WooCommerce plugin contains a stored cross‑site scripting flaw in its ‘xlwcty_current_date’ shortcode. Unsanitized user supplied attributes are output directly, allowing an attacker with contributor‑level or higher access to inject malicious scripts. When injected pages are visited, the scripts run in the context of the site, giving the attacker the ability to steal cookies, deface content, redirect users, or launch further attacks. The vulnerability is a classic input‑validation weakness (CWE‑79).

All WordPress sites running the NextMove Lite – Thank You Page for WooCommerce plugin with a version of 2.23.0 or earlier are impacted. The vulnerability exists in every release up to and including 2.23.0, and any site that has not upgraded beyond that version remains exposed.

The CVSS score of 6.4 places this flaw in the medium severity range. Because the EPSS score is not available and the flaw is not listed in CISA’s KEV catalogue, the likelihood of immediate exploitation is uncertain, but the required privilege level is relatively low (contributor+). The attack vector, while authenticated, is straightforward for users with the appropriate role, as they can add or modify shortcodes via the WordPress editor or plugin settings.