Description
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because core wp_filter_kses leaves the submitted markup inert, but the plugin's subsequent regex fallback consumes closing quotes of allowed attribute values containing 'bdt-', promoting previously inert bytes — such as event handlers like onfocus — into real HTML attributes that are then written to the database and rendered without further sanitization.
Published: 2026-10-28
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The plugin does not properly sanitize comment content, allowing an unauthenticated attacker to inject malicious scripts that are stored in the database. When a user visits a page containing the stored comment, the scripts execute in the visitor’s browser, enabling phishing, cookie theft, or site defacement.

Affected Systems

The Prime Slider Elementor Addons plugin for WordPress, with versions up to and including 4.7.2, is vulnerable. Sites that have the Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider modules installed and allow user comments can be impacted.

Risk and Exploitability

The flaw carries a CVSS score of 7.2, indicating high severity. The EPSS score is not available, so the exact exploitation probability is unknown, yet the vulnerability can be triggered by any visitor submitting a crafted comment. Because the attack requires no special privileges and the payload is stored for later rendering, it is readily exploitable. This vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 28, 2026 at 08:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Prime Slider to the latest version (4.7.3 or later) to eliminate the vulnerability.
  • If an update is not possible, disable the comment feature in the plugin’s settings to prevent new comments from being accepted.
  • Apply a security plugin or custom sanitization that escapes or removes dangerous attributes from comment content as a temporary workaround.

Generated by OpenCVE AI on October 28, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because core wp_filter_kses leaves the submitted markup inert, but the plugin's subsequent regex fallback consumes closing quotes of allowed attribute values containing 'bdt-', promoting previously inert bytes — such as event handlers like onfocus — into real HTML attributes that are then written to the database and rendered without further sanitization.
Title Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-28T06:45:15.943Z

Reserved: 2026-10-15T15:58:56.096Z

Link: CVE-2026-111111

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T07:16:46.680

Modified: 2026-10-28T07:16:46.680

Link: CVE-2026-111111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T09:00:10Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')