CVE-2026-101890

MediumCVSS 5.4

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.

Risk Assessment

An attacker can hijack an administrator session, execute arbitrary JavaScript in the context of the administrator's browser, potentially leading to data theft, content modification, or further compromise of the site.

Recommendation

Upgrade the Prime Mover plugin to version 2.2.1 or later, which includes a fix for the XSS vulnerability.

Other vulnerabilities in Prime Mover plugin

CVE-2026-101889Medium
The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS