An improper neutralization of input during web page generation (stored XSS) allows an attacker to embed malicious scripts that will execute when other users view a page containing the vulnerable slider. It is inferred that such scripts could compromise user session data, breach confidentiality, or alter the appearance of the site. The weakness is a result of insufficient input validation, classified as CWE‑79.

This issue affects the BdThemes Prime Slider – Addons For Elementor plugin, version 4.6.2 and earlier. All releases up to and including 4.6.2 are vulnerable, so sites running those versions are at risk.

The CVSS score of 6.5 places the flaw in the medium severity range. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that it may not have seen widespread exploitation yet. An attacker can exploit the flaw by injecting script code into an input field managed by the slider plugin; when the content is rendered, the code runs in visitors’ browsers. Because the input is stored, the attack can persist across sessions and affect any visitor to the affected pages.