The vulnerability stems from improper neutralization of user input during web page generation, allowing a stored XSS payload to persist within the WordPress Prime Slider – Addons For Elementor plugin. An attacker who can inject malicious code into slider content can cause that code to run in every visitor’s browser when the slider is displayed, potentially leading to session hijacking, cookie theft, or site defacement. The impact is a compromise of confidentiality and integrity of site user data and, in some cases, availability if the site is rendered unusable by injected scripts.

The flaw affects all installations of BdThemes Prime Slider – Addons For Elementor up to and including version 4.7.1 running on WordPress sites. Systems with a newer version, such as 4.7.2 or later, are not impacted.

With a CVSS score of 6.5 the vulnerability is considered moderate in severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no documented exploitation at this time. Exploitation likely requires the ability to edit slider content; an attacker could perform the attack by submitting a crafted script through the slider interface, which is then stored and later rendered to users. The attack vector is inferred to be a stored XSS scenario that could be triggered by any user with editing privileges for sliders.