Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 04:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

156-74% vs 7-day avg of 598

2 critical, 44 high, 62 medium, 28 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.8	CVE-2026-115806	The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Codexonics, Prime Mover, FreemiusCodexonics Prime Mover – Backup and Migration, Prime Mover – Backup and Migration, Freemius	NVD	Oct 24 05:17 UTC
CVE-2026-115806The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Executive summary The Prime Mover Backup and Migration plugin for WordPress has a flaw that lets an unauthenticated attacker plant malicious data through the comment form, which can be triggered when an administrator runs a routine export or restore. The advisory describes this as a PHP Object Injection issue that can enable serious compromise of the site. The advisory text provided does not state a fixed version or the vendor's specific recommendations. Technical summary The flaw is PHP Object Injection caused by unsafe deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker stores a base64-encoded serialized object in wp_comments.comment_content through wp-comments-post.php, and it is later decoded and passed to unserialize() without allowed_classes restriction when an administrator performs an export or restore. The advisory states a POP chain exists in the bundled Freemius library, so no additional plugin is required. All versions up to and including 2.2.1 are described as vulnerable. A fixed version, workaround, CVSS score, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Codexonics Prime Mover Freemius Codexonics Prime Mover – Backup and Migration Prime Mover – Backup and Migration Freemius NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	Medium	5.1	CVE-2026-101890	The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an... CodexonicsCodexonics Prime Mover	NVD	Oct 1 17:17 UTC
CVE-2026-101890The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an... From the advisory The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Codexonics Codexonics Prime Mover NIST National Vulnerability DatabasePublished Oct 1, 2026 17:17 UTC Read the advisory
	High	7.0	CVE-2026-101889	The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing... CodexonicsCodexonics Prime Mover	NVD	Oct 1 17:17 UTC
CVE-2026-101889The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing... From the advisory The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Codexonics Codexonics Prime Mover NIST National Vulnerability DatabasePublished Oct 1, 2026 17:17 UTC Read the advisory
	High	8.6	CVE-2026-101888	The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the... CodexonicsCodexonics Prime Mover	NVD	Oct 1 17:17 UTC
CVE-2026-101888The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the... From the advisory The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Codexonics Codexonics Prime Mover NIST National Vulnerability DatabasePublished Oct 1, 2026 17:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee