CVE-2026-101889

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tarrootfolder values in wprime-config.json. Attackers can exploit...

CVE-2026-101890

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped sitetitle value in a package's footprint.json file. Attackers can place a crafted package under the...

CVE-2026-101888

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

CVE-2026-101890 Prime Mover < 2.2.1 Stored XSS via Package Metadata

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped sitetitle value in a package's footprint.json file. Attackers can place a crafted package under the...

EUVD-2026-90917

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped sitetitle value in a package's footprint.json file. Attackers can place a crafted package under the...

CVE-2026-101890 Prime Mover < 2.2.1 Stored XSS via Package Metadata

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped sitetitle value in a package's footprint.json file. Attackers can place a crafted package under the...

CVE-2026-101890

The Prime Mover plugin for WordPress (versions before 2.2.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the improper handling of an unescaped site_title value within a package's footprint.json file. An attacker can place a crafted package in the prime-mover-expo...

EUVD-2026-90913

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tarrootfolder values in wprime-config.json. Attackers can exploit...

CVE-2026-101889

The Prime Mover plugin for WordPress (versions before 2.2.1 ) is vulnerable to a path traversal vulnerability. The issue stems from insufficient path validation within the computeExtractVariables() and validateImportedSiteVsPackage() functions. An authenticated administrator can exploit this by i...

CVE-2026-101889 Prime Mover < 2.2.1 Path Traversal via wprime-config.json

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tarrootfolder values in wprime-config.json. Attackers can exploit...

CVE-2026-101888

The Prime Mover plugin for WordPress (versions before 2.2.1 ) is vulnerable to a Zip Slip path traversal vulnerability. This flaw allows authenticated administrators to write arbitrary files outside the intended extraction directory during a migration ZIP import. The root cause lies in the comput...

EUVD-2026-90911

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

CVE-2026-101888 Prime Mover < 2.2.1 Zip Slip Path Traversal File Write

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

CVE-2026-101888 Prime Mover < 2.2.1 Zip Slip Path Traversal File Write

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

PT-2026-103911

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

PT-2026-103913

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site title value in a package's footprint.json file. Attackers can place a crafted package under the...

Prime Mover < 1.9.3 - Sensitive Data Exposure

Prime Mover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.2 via directory listing in the 'prime-mover-export-files/1/' folder. This makes it possible for unauthenticated attackers to extract sensitive data including site and...

CVE-2023-6505 Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

CVE-2023-6505 Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

Description The plugin does not prevent directory listing in sensitive directories containing export files. http://127.0.0.1/wordpress/wp-content/uploads/prime-mover-export-files/1/ 0 Go to packages and crate new If there is no backup now 1 Go to this URL manualy 2 Use Exploit...