Skip to content
Sign in
5.1 Medium

CVE-2026-101890 The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows…

Description

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.

Affected products and versions

Product Affected versions Fixed in
Prime Mover 2.2 earliest → < 2.2.1 2.2.1

Other CVEs of Prime Mover

The 3 CVEs of Prime Mover →
CVE-2026-101889 The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated… 7.0 High CVE-2026-101888 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows… 8.6 High
Track this CVE