CVE-2026-109691

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers with low privileges can inject persistent malicious scripts that execute when other users view affected pages. This requires an account with permission to edit or add Elementor slider content and an interacting user.

Root cause

The plugin fails to sanitize user-supplied input before embedding it into generated web pages, leading to stored cross-site scripting.

Affected systems

Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite) through 4.7.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade to a version higher than 4.7.1 once released; if an immediate update is not available, deactivate the plugin or restrict WordPress editor access to trusted users.

shell

$ wp plugin update bdthemes-prime-slider-lite

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.

References

https://patchstack.com/database/wordpress/plugin/bdthemes-prime-slider-lite/vulnerability/wordpress-prime-slider-addons-for-elementor-plugin-4-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109691