Prime Slider – Hero Slider, Carousel, Woocommerce & Post Slider Elementor Addons
Approved changes feed: RSS · Atom
cpe:2.3:a:bdthemes:prime_slider_–_hero_slider,_carousel,_woocommerce_&_post_slider_elementor_addons:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Bdthemes (5429b37a-0acd-5ad1-805d-fa178e11cdda) |
|---|---|
| Product | Prime Slider – Hero Slider, Carousel, Woocommerce & Post Slider Elementor Addons (b936ebc6-9c41-5d3e-bc32-448a291ef8bd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111111 |
vulnerable | 2026-11-03 10:16:11.597087 |
Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
HIGH (7.2)
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because core wp_filter_kses leaves the submitted markup inert, but the plugin's subsequent regex fallback consumes closing quotes of allowed attribute values containing 'bdt-', promoting previously inert bytes — such as event handlers like onfocus — into real HTML attributes that are then written to the database and rendered without further sanitization.
Published: 2026-10-28T06:45:15.943Z
Updated: 2026-10-29T01:41:52.430Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-92991 |
vulnerable | 2026-10-13 12:28:53.639116 |
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
MEDIUM (5.4)
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-09-18T02:27:53.439Z
Updated: 2026-09-18T12:47:47.065Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.