Finale Woocommerce Sales Countdown Timer Discount Vulnerabilities

The Finale Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.20.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tr...

CVSS:

6.1

Affected:

up to 2.20.0

Fix:

No patched version reported

Disclosed:

Jul 28, 2025

CVE-2025-52736 on NVD →

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdown timer in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

CVSS:

6.4

Affected:

up to 2.19.0

Fixed in:

2.20.0

Disclosed:

Mar 11, 2025

CVE-2024-12589 on NVD →

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.18.0. This is due to missing or incorrect nonce validation on the xlo_optin_call() function. This makes it possible for unauthenticated attackers to...

CVSS:

5.8

Affected:

up to 2.18.0

Fixed in:

2.18.1

Disclosed:

Apr 11, 2024

CVE-2024-32107 on NVD →

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, and including, 2.18.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to instal...

CVSS:

5.4

Affected:

up to 2.18.0

Fixed in:

2.18.1

Disclosed:

Mar 28, 2024

CVE-2024-30485 on NVD →

The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the download_tools_settings() function in all versions up to, and including, 2.17.0. This makes i...

CVSS:

5.3

Affected:

up to 2.17.0

Fixed in:

2.18.0

Disclosed:

Feb 29, 2024

CVE-2024-1120 on NVD →

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on one of its functions in all versions up to, and including, 2.16.0. This makes it possible for unauthenticated attackers to delete arbitrary content.

CVSS:

7.5

Affected:

up to 2.16.0

Fixed in:

2.17.0

Disclosed:

Oct 31, 2023

CVE-2023-47180 on NVD →

The Finale WooCommerce Sale Countdown plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the xl_maybe_push_support_request function in versions up to, and including, 2.9.0. This makes it possible for authenticated attackers to upload arbitrary files on the affected site'...

CVSS:

8.8

Affected:

up to 2.9.1

Fixed in:

2.9.1

Disclosed:

May 29, 2019