CVE-2026-105875
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Prime Slider – Addons For Elementor plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.6.2.
Risk Assessment
An attacker could inject a malicious script that is stored and executed in the user's browser, potentially leading to session data theft or account takeover.
Recommendation
Update the Prime Slider – Addons For Elementor plugin to the latest version available from the vendor that fixes this vulnerability.
Other vulnerabilities in Prime Slider – Addons For Elementor
See all- CVE-2026-4341Medium
The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.
- CVE-2025-68500Medium
The Prime Slider – Addons For Elementor plugin up to version 4.0.10 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to send requests from the server to internal resources.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS