Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (<= 4.7.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/prime-slider--hero-slider-carousel-woocommerce--post-slider-elementor-addons--4.7.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:27:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrime Slider WordPress plugin: Stored Cross-Site Scripting (CVE-2026-111111)https://feed.craftedsignal.io/briefs/2026-10-prime-slider-xss/Wed, 28 Oct 2026 08:27:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-prime-slider-xss/The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious HTML attributes that execute in the context of victim browsers.The Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress (versions up to and including 4.7.2) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin utilizes a regex fallback mechanism that improperly parses input attributes, specifically by consuming the closing quotes of allowed attributes. This action promotes previously inert bytes, such as event handlers (e.g., onfocus), into active HTML attributes. These malicious payloads are stored in the database and subsequently executed when a victim views the affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a user viewing the injected content. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.

Recommendation

  • Update the "Prime Slider - Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons" plugin to a version released after 4.7.2.
  • Until patching is possible, restrict access to administrative interfaces and pages utilizing the plugin to authorized users only.
  • Implement a Web Application Firewall (WAF) to filter incoming HTTP requests for suspicious HTML event handlers and script tags in the 'comment' parameter.
]]>highadvisorywordpressxssweb-applicationcve