Prime Slider CVE-2026-105875

Exploitation requires an authenticated WordPress account with at least contributor/author-level privileges (PR:L) capable of using the Prime Slider plugin's Elementor widgets to save content, plus victim interaction (UI:R): a higher-privileged user must view the page containing the stored payload for the script to fire. Limiting factors: the attacker cannot be fully anonymous (some authenticated access to the editing interface is needed), the impact is realized only when another user renders the malicious content, and the Prime Slider plugin (version 4.6.2 or earlier) must be installed and active. The scope change (S:C) means the payload executes in the security context of the viewing user rather than the attacker's.

This is a medium-severity (CVSS 6.5) stored XSS in the BdThemes Prime Slider WordPress plugin, and the available signals point to a moderate, not critical, priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L shows network attack vector with low complexity but requires privileges (PR:L - an authenticated contributor/author-level account) and victim user interaction (UI:R), which materially constrains real-world exploitation. The changed scope (S:C) correctly reflects that injected script executes in the browser context of other users (e.g. admins), but each impact dimension is only Low. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - the only source is the Patchstack advisory. Absence of KEV/EPSS/POC data means exploitation probability cannot be quantified from the input; this appears to be a typical authenticated stored-XSS plugin flaw reported through a vulnerability-research program rather than evidence of active targeting. One note to verify: the description says 'from n/a through 4.6.2,' leaving the lower affected bound undefined - treat all versions up to and including 4.6.2 as affected pending vendor confirmation.

An attacker with a low-privileged authenticated WordPress account (e.g. contributor) uses a Prime Slider element/widget to save a payload containing malicious JavaScript into page content. When a higher-privileged user such as an administrator later views the affected page in the wp-admin or on the front end, the stored script executes in their browser, enabling session/cookie theft or admin actions on their behalf. No public exploit code was identified at time of analysis.