Prime Slider WordPress plugin: Stored Cross-Site Scripting (CVE-2026-111111)

The Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress (versions up to and including 4.7.2) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin utilizes a regex fallback mechanism that improperly parses input attributes, specifically by consuming the closing quotes of allowed attributes. This action promotes previously inert bytes, such as event handlers (e.g., onfocus), into active HTML attributes. These malicious payloads are stored in the database and subsequently executed when a victim views the affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a user viewing the injected content. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.

Recommendation

• Update the "Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons" plugin to a version released after 4.7.2.
• Until patching is possible, restrict access to administrative interfaces and pages utilizing the plugin to authorized users only.
• Implement a Web Application Firewall (WAF) to filter incoming HTTP requests for suspicious HTML event handlers and script tags in the 'comment' parameter.