CVE-2026-0703: NextMove Lite WooCommerce Plugin XSS Flaw

CVE-2026-0703 Overview

CVE-2026-0703 is a Stored Cross-Site Scripting (XSS) vulnerability in the NextMove Lite – Thank You Page for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.23.0 and resides in the plugin's xlwcty_current_date shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. The injected scripts execute in the browsers of any users who view affected pages. This vulnerability is classified under CWE-79.

Critical Impact

Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and arbitrary actions performed in the context of visitors and site administrators.

Affected Products

• NextMove Lite – Thank You Page for WooCommerce plugin for WordPress
• All versions up to and including 2.23.0
• WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

• 2026-05-02 - CVE-2026-0703 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-0703

Vulnerability Analysis

The vulnerability resides in the plugin's shortcode handler for xlwcty_current_date, defined in merge-tags/xlwcty-shortcode-merge-tags.php. The shortcode accepts user-controlled attributes and renders them back into page output without proper sanitization or escaping. When a contributor or higher-privileged user embeds the shortcode with crafted attribute values, the malicious payload is stored in post content and served to every visitor of that page.

Because the script executes in the context of the WordPress site origin, attackers can hijack authenticated sessions, perform actions on behalf of administrators, or pivot to additional plugin endpoints. The scope change in the CVSS vector reflects that an injected payload affects users beyond the attacker's own privilege boundary.

Root Cause

The root cause is missing output escaping on shortcode attribute values processed at lines 79 and 87 of xlwcty-shortcode-merge-tags.php. The plugin passes attribute values directly into rendered HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). Combined with insufficient input sanitization on the shortcode parameters, this produces a classic stored XSS sink [CWE-79].

Attack Vector

An authenticated attacker holding contributor privileges or higher creates or edits a post and inserts the xlwcty_current_date shortcode with a malicious attribute value containing JavaScript. WordPress stores the post content and renders the shortcode whenever a user views the page. The injected script executes with the visitor's session, allowing the attacker to exfiltrate cookies, perform CSRF-style actions, or escalate to administrator accounts. No user interaction beyond visiting the page is required.

The vulnerability mechanism is described in the WordPress Plugin Code Review at line 79 and line 87. No public exploit code is currently available.

Detection Methods for CVE-2026-0703

Indicators of Compromise

• Post or page content containing xlwcty_current_date shortcodes with attribute values that include <script>, javascript:, or HTML event handlers such as onerror= or onload=
• Unexpected JavaScript executing on WordPress thank-you pages or WooCommerce confirmation pages
• Outbound requests from visitor browsers to attacker-controlled domains shortly after viewing pages that render the shortcode
• Newly created administrator accounts or modified user roles following contributor activity

Detection Strategies

• Audit the wp_posts table for shortcode usage matching xlwcty_current_date with suspicious attribute payloads using SQL queries against post content
• Review WordPress audit logs for contributor-level users creating or editing posts that embed the vulnerable shortcode
• Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to /wp-admin/post.php for shortcode attributes containing script tags or JavaScript URI schemes

Monitoring Recommendations

• Monitor plugin inventories for woo-thank-you-page-nextmove-lite versions at or below 2.23.0 and prioritize patching
• Enable WordPress activity logging plugins to capture post edits, shortcode insertions, and role changes for forensic review
• Track Content Security Policy (CSP) violation reports to identify inline script execution attempts on storefront pages

How to Mitigate CVE-2026-0703

Immediate Actions Required

• Update the NextMove Lite – Thank You Page for WooCommerce plugin to the version released after 2.23.0 that contains the fix referenced in WordPress Change Set 3482613
• Audit existing posts and pages for malicious xlwcty_current_date shortcode usage and remove any injected payloads before applying the patch
• Review contributor-level and higher accounts for unexpected activity, and rotate credentials for any account showing suspicious post edits

Patch Information

The vendor addressed the vulnerability in the changeset documented at WordPress Change Set 3482613. The fix applies proper sanitization and escaping to the affected shortcode attributes. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict contributor and author roles on production sites until the patched plugin version is deployed
• Disable or remove the NextMove Lite plugin if patching cannot be performed immediately
• Deploy a WAF or virtual patching rule to block POST requests containing xlwcty_current_date shortcodes with script-bearing attributes
• Apply a strict Content Security Policy that disallows inline scripts on customer-facing WooCommerce pages

# Example WP-CLI commands to identify and mitigate exposure
wp plugin get woo-thank-you-page-nextmove-lite --field=version
wp plugin update woo-thank-you-page-nextmove-lite
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%xlwcty_current_date%';"