Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Front-End Component Attributes
- ID
- WPSEC-2026-0874
- Plugin
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (bdthemes-prime-slider-lite)
- Affected
- all versions before 4.7.2
- Remediation
- Update to 4.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons on WPSec AttackSurface
- Fix released
- Published
Description
The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bdt-' and 'data-bdt-' component attributes (such as 'data-bdt-svg') in post content, excerpts and Elementor data in all versions up to, and including, 4.7.1. This is due to an incomplete fix for an earlier issue. The plugin stripped these attributes before kses ran, so markup hidden inside raw-text elements such as <style> was skipped by the plugin's filter and then exposed when kses removed the surrounding tag. Content stored before the filter existed was also never cleaned when rendered. On top of that, the bundled front-end script loaded SVG sources from any origin and did not remove SVG animation elements that set a javascript: URL. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, including an administrator, accesses an injected page that loads the plugin's front-end bundle.
References
- https://wpsec.com/vuln/WPSEC-2026-0874/
- https://plugins.svn.wordpress.org/bdthemes-prime-slider-lite/tags/4.7.2/
- https://wordpress.org/plugins/bdthemes-prime-slider-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS