{"id":"CVE-2026-101890","published":"2026-10-01T17:17:17.767","lastModified":"2026-10-02T18:00:34.733","description":"The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wordpress.org/plugins/prime-mover/#developers","tags":[]},{"url":"https://www.vulncheck.com/advisories/prime-mover-stored-xss-via-package-metadata","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}