CVE-2026-109691 BdThemes CVE debrief

Who should care

Defenders responsible for WordPress installations with Prime Slider – Addons For Elementor plugin versions up to 4.7.1 should verify exposure and apply patches. The vulnerability can be mitigated by updating to a patched version of the plugin. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should check relevant monitoring, detection, and logs for exposed assetsthat

Why it matters

CVE-2026-109691 is a Cross Site Scripting (XSS) vulnerability affecting WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1. Defenders should prioritize verifying exposure and applying patches.

• Verify exposure of WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1
• Apply patches for WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1
• Monitor for potential XSS attacks

Technical summary

The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Cross Site Scripting (XSS) in versions up to 4.7.1. The vulnerability allows for Stored XSS, which can be exploited by attackers to inject malicious scripts into web pages. The vulnerability is caused by improper neutralization of input during web page generation. Defenders should prioritize verifying exposure and applying patches to mitigate the vulnerability. The plugin is used by WordPress users to create sliders and other interactive elements on their websites.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1.

Recommended defensive actions

• Verify exposure of WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1
• Apply patches for WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1
• Monitor for potential XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the XSS vulnerability in Prime Slider – Addons For Elementor plugin versions up to 4.7.1. The vulnerability is caused by improper neutralization of input during web page generation. The CVE record was published on 2026-10-13T08:39:18.284Z and has not been modified since then. The source item provides additional information on the vulnerability, including its severity and potential impact. Defenders should verify exposure and apply patches to mitigate the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.