{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/prime-slider--hero-slider-carousel-woocommerce--post-slider-elementor-addons--4.7.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:prime_slider:prime_slider:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111111"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Prime Slider – Hero Slider, Carousel, WooCommerce \u0026 Post Slider Elementor Addons (\u003c= 4.7.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Prime Slider - Hero Slider, Carousel, WooCommerce \u0026amp; Post Slider Elementor Addons plugin for WordPress (versions up to and including 4.7.2) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin utilizes a regex fallback mechanism that improperly parses input attributes, specifically by consuming the closing quotes of allowed attributes. This action promotes previously inert bytes, such as event handlers (e.g., onfocus), into active HTML attributes. These malicious payloads are stored in the database and subsequently executed when a victim views the affected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a user viewing the injected content. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Prime Slider - Hero Slider, Carousel, WooCommerce \u0026amp; Post Slider Elementor Addons\u0026quot; plugin to a version released after 4.7.2.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, restrict access to administrative interfaces and pages utilizing the plugin to authorized users only.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to filter incoming HTTP requests for suspicious HTML event handlers and script tags in the 'comment' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T08:27:32Z","date_published":"2026-10-28T08:27:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-prime-slider-xss/","summary":"The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious HTML attributes that execute in the context of victim browsers.","title":"Prime Slider WordPress plugin: Stored Cross-Site Scripting (CVE-2026-111111)","url":"https://feed.craftedsignal.io/briefs/2026-10-prime-slider-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Prime Slider – Hero Slider, Carousel, WooCommerce \u0026 Post Slider Elementor Addons (\u003c= 4.7.2)","version":"https://jsonfeed.org/version/1.1"}