Prime Slider Addons For Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget – CVE-2024-1506 |WordPress Plugin Vulnerability Report

Plugin Name: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)

Key Information:

  • Software Type: Plugin
  • Software Slug: bdthemes-prime-slider-lite
  • Software Status: Active
  • Software Author: bdthemes
  • Software Downloads: 1,987,618
  • Active Installs: 100,000
  • Last Updated: March 8, 2024
  • Patched Versions: 3.13.2
  • Affected Versions: <= 3.13.1

Vulnerability Details:

  • Name: Prime Slider – Addons For Elementor <= 3.13.1
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1506
  • CVSS Score: 6.4
  • Publicly Published: March 6, 2024
  • Researcher: Wesley
  • Description: The vulnerability resides in the 'title_tags' attribute of the Fiestar widget of the Prime Slider plugin, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject harmful scripts. These scripts can be executed by users visiting the affected pages, leading to potential security breaches.


Prime Slider – Addons For Elementor, a popular plugin enhancing Elementor with advanced slider features, has been identified with a critical vulnerability in versions up to 3.13.1. This Stored Cross-Site Scripting vulnerability, patched in version 3.13.2, posed a significant risk to WordPress sites by allowing malicious script injection.

Detailed Overview:

This vulnerability was discovered by security researcher Wesley, who noted that the plugin failed to properly sanitize user input within the Fiestar widget's 'title_tags' attribute. Such vulnerabilities are particularly concerning as they can lead to unauthorized data access, site defacement, and other malicious activities. The swift action taken by bdthemes to release a patched version is commendable and crucial for maintaining the security integrity of WordPress sites using this plugin.

Advice for Users:

  • Immediate Action: Users should immediately update to the patched version 3.13.2 to eliminate this vulnerability from their WordPress installations.
  • Check for Signs of Vulnerability: It's essential to monitor your site for any unusual activity or content that could indicate exploitation of this vulnerability.
  • Alternate Plugins: While the patched version is secure, exploring alternative slider plugins for Elementor could provide additional security and functionality.
  • Stay Updated: Regularly updating plugins is a cornerstone of website security, ensuring protection against known vulnerabilities.


The quick resolution of CVE-2024-1506 by the developers of Prime Slider – Addons For Elementor highlights the critical nature of ongoing vigilance and prompt updates in the cybersecurity landscape. Users are urged to apply the update to ensure their WordPress sites remain secure against potential exploits.


In today's fast-paced digital world, the security of your WordPress site is as crucial as its content and design. The recent discovery of a significant vulnerability in the Prime Slider – Addons For Elementor plugin serves as a stark reminder of the continuous battle between advancing technology and the persistence of cyber threats. Identified as CVE-2024-1506, this vulnerability exposes the delicate balance website owners must maintain between functionality and security, emphasizing the indispensable nature of regular plugin updates.

Prime Slider – Addons For Elementor: A Snapshot

This popular plugin, developed by bdthemes, enhances the Elementor page builder with sophisticated slider features, including the Revolution slider, Hero slider, and Ecommerce slider. With over 1.9 million downloads and 100,000 active installations, its widespread use underlines the impact of any vulnerability. Despite its popularity, the plugin faced a critical security issue in versions up to 3.13.1, patched in the subsequent 3.13.2 update.

Unpacking CVE-2024-1506

CVE-2024-1506 targets the 'title_tags' attribute of the Fiestar widget within the plugin, where inadequate input sanitization and output escaping pave the way for attackers to inject malicious scripts. These scripts can execute on the user's device upon visiting the compromised pages, leading to potential unauthorized access and data breaches. This vulnerability, publicized by researcher Wesley on March 6, 2024, underscores the ever-present need for vigilance in the digital realm.

Potential Risks and Implications

The exploitation of this vulnerability could lead to severe consequences, including but not limited to data theft, website defacement, and the undermining of user trust. For small business owners, the stakes are particularly high as such security breaches can not only tarnish reputation but also entail legal and financial repercussions.

Remedial Measures and Best Practices

The immediate course of action involves updating to version 3.13.2, which addresses this vulnerability. Furthermore, regularly monitoring your site for any signs of compromise and considering alternative plugins for enhanced security can fortify your defense against such vulnerabilities. Maintaining a regime of regular updates for all installed plugins is not just advisable; it's a necessity for safeguarding your online presence.

Historical Context

With three previous vulnerabilities reported since March 4, 2022, the security history of Prime Slider – Addons For Elementor suggests a pattern that necessitates ongoing vigilance from its users and developers alike.

In conclusion, the resolution of CVE-2024-1506 by bdthemes exemplifies the critical importance of prompt and proactive responses to security threats in the digital landscape. For small business owners, this incident highlights the imperative of staying informed and up-to-date on potential vulnerabilities within their WordPress environment. In an era where digital assets are invaluable, ensuring the security of your WordPress site through regular updates and diligent practices is not just beneficial—it's essential for sustained success and trust in the digital marketplace.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Addons For Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget – CVE-2024-1506 |WordPress Plugin Vulnerability Report – Prime Slider FAQs

Leave a Comment