PT-2026-103913

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site title value in a package's footprint.json file. Attackers can place a crafted package under the...