# Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Front-End Component Attributes

- **ID:** WPSEC-2026-0874
- **Plugin:** Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (`bdthemes-prime-slider-lite`), https://wordpress.org/plugins/bdthemes-prime-slider-lite/
- **Affected versions:** all versions before 4.7.2
- **Fixed in:** 4.7.2 (Update to 4.7.2 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bdthemes-prime-slider-lite
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0874/

## Description

The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bdt-' and 'data-bdt-' component attributes (such as 'data-bdt-svg') in post content, excerpts and Elementor data in all versions up to, and including, 4.7.1. This is due to an incomplete fix for an earlier issue. The plugin stripped these attributes before kses ran, so markup hidden inside raw-text elements such as <style> was skipped by the plugin's filter and then exposed when kses removed the surrounding tag. Content stored before the filter existed was also never cleaned when rendered. On top of that, the bundled front-end script loaded SVG sources from any origin and did not remove SVG animation elements that set a javascript: URL. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, including an administrator, accesses an injected page that loads the plugin's front-end bundle.

## References

- https://wpsec.com/vuln/WPSEC-2026-0874/
- https://plugins.svn.wordpress.org/bdthemes-prime-slider-lite/tags/4.7.2/
- https://wordpress.org/plugins/bdthemes-prime-slider-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0874/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.