Prime Slider – Addons For Elementor: Low-privilege stored cross-site scripting
An authenticated attacker with low privileges (PR:L) can persist script-capable input that is rendered without sufficient neutralization. Script executes in a victim browser under the site's origin when the affected output is viewed (UI:R). The exact WordPress role, stored field, request endpoint and rendering function are undisclosed; reaching an administrator is conditional on that user viewing the output. Affected versions: <= 4.6.2. The authoritative export identifies 4.7.0 as fixed for this CVE.
- Component
- Prime Slider – Addons For Elementor
- Plugin slug
bdthemes-prime-slider-lite- Affected
- <= 4.6.2
- Safe version
4.7.0- Published
- Oct 07, 2026
This CVE was published Oct 07, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to 4.7.0 or a later supported release. Validate stored content and apply context-appropriate escaping when rendering it. Enforce the intended editing capability and remove malicious persisted values.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L