CVE-2026-109691
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS. This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Risk Assessment
An attacker can inject a malicious script that is stored and executed in other users' browsers, potentially leading to session theft or account takeover. This affects the confidentiality and integrity of the WordPress site.
Recommendation
Update the Prime Slider – Addons For Elementor plugin to a version newer than 4.7.1. Consider implementing CSP headers and auditing user-submitted content.
Other vulnerabilities in Prime Slider – Addons For Elementor
See all- CVE-2026-105875Medium
The Prime Slider – Addons For Elementor plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.6.2.
- CVE-2026-4341Medium
The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.
- CVE-2025-68500Medium
The Prime Slider – Addons For Elementor plugin up to version 4.0.10 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to send requests from the server to internal resources.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS