CVE-2026-109691: WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BdThemes Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite)to a version that resolves this vulnerability.Fixed in 4.7.2
Event History
Frequently Asked Questions
Does exploitation require attacker privileges or victim interaction?
Yes. The CVSS vector indicates low privileges are required and user interaction is required for exploitation.
Which deployments fall within the affected version range?
The issue affects Prime Slider – Addons For Elementor versions through 4.7.1. The provided data does not identify a fixed version.
What impact can successful exploitation have?
The CVSS assessment indicates low impact to confidentiality, integrity, and availability, with scope changed.