XLPlugins records

11 published records for vendor xlplugins.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 54.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

11 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2024-25092Proof of concept	WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerabilityxlplugins · nextmove · CWE-862 Broken access control (IDOR)	High8.8	—	1.4%	Jun 9, 2024
35Monitor	CVE-2024-30485Proof of concept	WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerabilityxlplugins · finale · CWE-862 Broken access control (IDOR)	High8.8	—	1.0%	Jun 9, 2024
28Monitor	CVE-2025-52735No exploit	WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerabilityxlplugins · nextmove · CWE-79 Pre-auth XSS	High7.1	—	0.3%	Oct 22, 2025
26Monitor	CVE-2023-47180No exploit	WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerabilityxlplugins · finale · CWE-862 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.4%	Jan 2, 2025
26Monitor	CVE-2025-62969No exploit	WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerabilityxlplugins · nextmove · CWE-79 XSS	Medium6.5	—	0.2%	Oct 26, 2025
24Monitor	CVE-2023-39162No exploit	WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)xlplugins · woo-confirmation-email · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Sep 4, 2023
21Monitor	CVE-2024-1120No exploit	NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticxlplugins · finale · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.5%	Mar 1, 2024
21Monitor	CVE-2024-12589No exploit	Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timexlplugins · finale · CWE-79 XSS	Medium5.4	—	0.3%	Mar 12, 2025
17Monitor	CVE-2024-32104Proof of concept	WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerabilityxlplugins · nextmove · CWE-352 Pre-auth CSRF	Medium4.3	—	0.7%	Apr 15, 2024
17Monitor	CVE-2024-10860No exploit	NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submissionxlplugins · nextmove · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.3%	Feb 28, 2025
17Monitor	CVE-2024-32107No exploit	WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerabilityxlplugins · finale · CWE-352 Pre-auth CSRF	Medium4.3	—	0.2%	Apr 11, 2024

CVE-2024-25092
35Monitor
WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability
HighCVSS 8.8Proof of conceptEPSS 1%
- Broken access control (IDOR)
xlplugins · nextmoveJun 9, 2024
CVE-2024-30485
35Monitor
WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability
HighCVSS 8.8Proof of conceptEPSS 1%
- Broken access control (IDOR)
xlplugins · finaleJun 9, 2024
CVE-2025-52735
28Monitor
WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
xlplugins · nextmoveOct 22, 2025
CVE-2023-47180
26Monitor
WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
xlplugins · finaleJan 2, 2025
CVE-2025-62969
26Monitor
WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- XSS
xlplugins · nextmoveOct 26, 2025
CVE-2023-39162
24Monitor
WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
xlplugins · woo-confirmation-emailSep 4, 2023
CVE-2024-1120
21Monitor
NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthentic
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
xlplugins · finaleMar 1, 2024
CVE-2024-12589
21Monitor
Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Time
MediumCVSS 5.4No exploitEPSS 0%
- XSS
xlplugins · finaleMar 12, 2025
CVE-2024-32104
17Monitor
WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability
MediumCVSS 4.3Proof of conceptEPSS 1%
- Pre-auth
- CSRF
xlplugins · nextmoveApr 15, 2024
CVE-2024-10860
17Monitor
NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
xlplugins · nextmoveFeb 28, 2025
CVE-2024-32107
17Monitor
WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerability
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
xlplugins · finaleApr 11, 2024