CVE-2026-109691 in Prime Slider Plugin
Summary
by MITRE • 10/13/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a classic instance of improper neutralization of input during web page generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the BdThemes Prime Slider – Addons For Elementor plugin for WordPress. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs, stored vulnerabilities persist on the target server because the injected payload is saved in the application's database. This means that every time a user loads the affected page containing the slider component, the malicious script is retrieved from storage and rendered by the victim’s browser without any additional interaction required to trigger it beyond viewing the content. The vulnerability affects versions of Prime Slider – Addons For Elementor ranging from no specific lower bound up through version 4.7.1, indicating a broad scope of potentially compromised installations that have not applied subsequent patches or updates.
From a technical perspective, this flaw typically arises when user-supplied data is inserted into an HTML context without adequate validation, sanitization, or encoding. In the context of WordPress plugins utilizing Elementor page builder architecture, inputs such as slider titles, captions, descriptions, or custom fields are often processed and rendered directly into the DOM. If these inputs contain executable JavaScript code rather than being treated strictly as plain text, the browser interprets them as active content. The absence of proper output encoding allows attackers to inject scripts that can execute arbitrary commands within the context of the victim's session. This bypasses same-origin policy restrictions because the script is served from a trusted domain, granting it full access to cookies, local storage, and other sensitive data associated with that site.
The operational impact of this vulnerability is severe due to its persistent nature. Once an attacker successfully injects malicious code into a slider element, all users who visit the page where that slider appears will execute the script in their browsers. This can lead to session hijacking, where attackers steal authentication cookies and take over user accounts with administrative privileges if they target site administrators or editors. It also enables credential harvesting through fake login forms injected via DOM manipulation, defacement of the website by altering displayed content, and redirection of users to malicious phishing sites. Furthermore, stored XSS can be used to distribute malware by loading external scripts that exploit browser vulnerabilities or prompt downloads of infected files under the guise of legitimate software updates.
This vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Cross-site Scripting (XSS). In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript. The attack vector generally involves an attacker with the ability to submit content that is stored on the server, such as through comment sections, user profiles, or administrative input fields within the plugin's configuration interface. Because the payload persists, it creates a long-term risk even after the initial injection point has been secured, requiring proactive monitoring and cleanup of existing database entries containing malicious scripts.
Mitigation strategies must focus on both immediate remediation and long-term defense in depth. The primary solution is to upgrade the BdThemes Prime Slider – Addons For Elementor plugin to a version newer than 4.7.1 where this vulnerability has been patched by the developers through improved input validation and output encoding mechanisms. Administrators should also implement Web Application Firewalls that can detect and block common XSS payloads in HTTP requests, providing an additional layer of defense against exploitation attempts. Additionally, enforcing Content Security Policy headers on the web server can significantly reduce the impact of any successful injection by restricting the sources from which scripts are allowed to load or execute. Regular security audits and code reviews for custom plugins are essential to ensure that future updates do not reintroduce similar flaws in input handling processes.