Skip to content
Noroxi

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons

bdthemes-prime-slider-lite · plugin

Known security vulnerabilities for Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

latest Apr 8, 2026

Listed on wordpress.org · latest 4.6.2 · last updated Sep 30, 2026 · 100K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2024-32682login required≤ 3.13.2

    WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability

    High 8.8

  • CVE-2024-32681login required≤ 3.13.2

    WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability

    High 8.8

  • CVE-2026-4341contributor+≤ 4.1.10

    Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter

    Medium 6.4

  • CVE-2024-30186login required≤ 3.13.1

    WordPress Prime Slider plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-12043contributor+≤ 3.16.5

    Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-8442contributor+≤ 3.15.18

    Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-5640contributor+≤ 3.14.7

    Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-4339contributor+≤ 3.14.3

    Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-1730contributor+≤ 3.14.0

    Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.1

    Medium 5.4

  • CVE-2024-1508contributor+≤ 3.13.2

    Prime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget

    Medium 5.4

  • CVE-2024-1507contributor+≤ 3.13.3

    Prime Slider – Addons For Elementor <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget

    Medium 5.4

  • CVE-2024-1506contributor+≤ 3.13.1

    Prime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget

    Medium 5.4

  • CVE-2025-68500login required≤ 4.0.10

    WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability

    Medium 4.9

  • CVE-2025-14277subscriber+≤ 4.0.9

    Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery

    Medium 4.3

  • CVE-2024-24883login required≤ 3.11.10

    WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory