Prime Mover CVE-2026-101890

Exploitation requires (1) the ability to place a crafted package - specifically a footprint.json file containing a malicious, unescaped site_title value - inside the plugin's prime-mover-export-files directory, which per the CVSS PR:L implies authenticated low-privilege access or another write path to that directory; and (2) an administrator subsequently viewing the Prime Mover Packages list table in wp-admin, where column_site_title() in PrimeMoverBackupMenuListTable.php renders the value unescaped (the UI:P passive-interaction requirement). Package restoration is explicitly NOT required. Limiting factors: only Prime Mover versions before 2.2.1 are affected; the attacker needs a prior foothold to write the package file; and the payload is inert until a privileged user opens the specific admin list table, bounding this to targeted post-compromise scenarios rather than drive-by unauthenticated attacks.

This is a moderate, not high-priority, issue. The only severity signal present is a vendor/CVSS 4.0 score of 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P with impact confined to subsequent-system confidentiality and integrity, SC:L/SI:L). No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis.' The CVSS vector itself tempers the network attack vector: PR:L means the attacker must already be authenticated at a low privilege level, and UI:P means an administrator must passively view the affected list table for the payload to fire. The signals are internally consistent (stored XSS firing in an admin browser, hence the subsequent-system scope impact and N on vulnerable-system C/I/A), so there is no conflict to flag - but note that EPSS and any in-the-wild telemetry are simply absent, so widespread automated exploitation cannot be assessed. Realistically this is a privilege-escalation/admin-session-compromise path contingent on a prior foothold, not a wormable unauthenticated bug.

A low-privileged authenticated user (or an attacker who has gained the ability to write to the plugin's export directory) places a crafted package whose footprint.json carries a malicious site_title containing JavaScript. When an administrator later opens the Prime Mover Packages list table, the unescaped value renders in column_site_title() and executes script in the admin's browser - no package restore is required. No public POC was provided, so this reflects the described mechanism rather than confirmed exploit code.