Prime Slider EUVD-2026-98360

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L - consistent with a contributor/author-type role able to submit content through Prime Slider or its Elementor widgets), and it requires victim interaction (UI:R): a separate, typically higher-privileged user must render the page containing the stored payload for the script to fire. Limiting factors that reduce realistic risk: the attacker cannot act fully unauthenticated, the site must be running Prime Slider ≤ 4.7.1, and the impact depends on a privileged user actually viewing the injected content. It is not remote-unauthenticated against a default install.

This is a moderate-priority, not a drop-everything, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5 MEDIUM) describes a network-reachable but authenticated stored XSS that requires both low-privilege access (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation or weaponization - the only intelligence source is a single Patchstack database entry. The real-world risk is therefore driven by likelihood of a malicious or compromised low-privilege WordPress user (e.g., contributor/author) rather than by opportunistic mass exploitation. Signals are internally consistent here: a MEDIUM CVSS, no KEV, and no POC all point to a genuine-but-lower-urgency vulnerability rather than a high-CVSS-but-low-real-risk mislabel or a quiet critical. Key missing data to note explicitly: EPSS probability is absent, POC status is unconfirmed (not stated either way), and the exact privilege level WordPress requires (contributor vs. author/editor) is not enumerated in the description - verify against the Patchstack advisory.

An attacker holding a low-privilege authenticated WordPress account (such as contributor or author) on a site running Prime Slider ≤ 4.7.1 injects malicious JavaScript into a plugin-controlled field or Elementor widget input that is stored without proper neutralization. When a higher-privileged user - typically an administrator reviewing content in wp-admin - views the affected page, the stored script executes in their browser session. No public exploit code is identified at time of analysis, but stored XSS of this class is straightforward to craft given a valid account.