Description (CNA)
The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Codexonics / Prime Mover | affected 0 before 2.2.1 |
CWE
CWE-79
References
- https://wordpress.org/plugins/prime-mover/#developers
- https://www.vulncheck.com/advisories/prime-mover-stored-xss-via-package-metadata
ADP enrichment
No English description supplied.
No references supplied.