Prime Slider Vulnerability – Authenticated Stored Cross-Site Scripting via Rubix Widget – CVE-2024-1507 | WordPress Plugin Vulnerability Report – 

Plugin Name: Prime Slider – Addons For Elementor

Key Information:

  • Software Type: Plugin
  • Software Slug: bdthemes-prime-slider-lite
  • Software Status: Active
  • Software Author: bdthemes
  • Software Downloads: 2,042,074
  • Active Installs: 100,000
  • Last Updated: March 13, 2024
  • Patched Versions: 3.13.3
  • Affected Versions: <= 3.13.2

Vulnerability Details:

  • Name: Prime Slider – Addons For Elementor <= 3.13.2
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1507
  • CVSS Score: 6.4
  • Publicly Published: March 12, 2024
  • Researcher: Nikolas - mdr
  • Description: The Prime Slider – Addons For Elementor plugin is susceptible to Stored Cross-Site Scripting attacks through the 'title_tags' attribute in the Rubix widget up to version 3.13.2, due to insufficient input sanitization and output escaping. This flaw allows authenticated users with contributor status or higher to embed arbitrary scripts, which are then executed when others access the compromised pages.


The popular WordPress plugin, Prime Slider, designed to enhance Elementor with advanced slider functionalities, has encountered a critical security flaw in versions up to 3.13.2. This vulnerability, designated as CVE-2024-1507, allows for Authenticated Stored Cross-Site Scripting (XSS) attacks via the plugin's Rubix widget, posing a considerable risk to website security and user data privacy. Fortunately, this issue has been rectified in the latest update, version 3.13.3.

Detailed Overview:

Discovered by the cybersecurity researcher Nikolas - mdr, this vulnerability highlights the importance of rigorous input sanitization and output encoding practices in web development. The potential for authenticated users to exploit this vulnerability underscores the need for robust security measures and vigilant user role management on WordPress sites.

Advice for Users:

  • Immediate Action: Users should promptly update the Prime Slider plugin to the patched version 3.13.3 via the WordPress dashboard to safeguard against this vulnerability.
  • Check for Signs of Vulnerability: Regular site audits for unexpected content alterations or functionalities are recommended to detect possible exploitation signs.
  • Alternate Plugins: While the patched version addresses this specific vulnerability, exploring alternative slider plugins might offer additional security features or better suit user needs.
  • Stay Updated: Consistently updating all WordPress elements, including themes, plugins, and the core, is vital for security and site performance.


The resolution of CVE-2024-1507 in the Prime Slider plugin serves as a crucial reminder of the ongoing need for cybersecurity diligence in the WordPress community. For website administrators, particularly those managing sites for small businesses, recognizing the importance of timely software updates is paramount. Implementing proactive security measures, such as regular updates and user access control, is key to maintaining a secure online environment.


  • Wordfence Vulnerability Report on Prime Slider
  • Additional Information on Prime Slider Vulnerabilities

In the digital forefront where WordPress reigns supreme for many businesses and personal ventures, maintaining up-to-date and secure plugins is not just a recommendation—it's a necessity. The recent uncovering of a vulnerability within the "Prime Slider – Addons For Elementor" plugin, a cornerstone for countless WordPress sites seeking dynamic slider functionalities, casts a spotlight on this critical cybersecurity tenet. Identified as CVE-2024-1507, this vulnerability exposes sites to potential Authenticated Stored Cross-Site Scripting (XSS) attacks, emphasizing the ongoing battle against digital threats.

Plugin Overview:

"Prime Slider" enriches Elementor with its sophisticated slider capabilities, boasting over 2 million active installations. Developed by "bdthemes," this plugin has been a go-to solution for seamlessly integrating various slider features into WordPress sites. However, its widespread use also means that vulnerabilities within it can have far-reaching implications.

Vulnerability Insights:

CVE-2024-1507 pinpoints a significant security flaw in versions up to and including 3.13.2, where the 'title_tags' attribute of the Rubix widget lacks proper input sanitization and output escaping. This oversight allows authenticated individuals, even those with just contributor-level access, to inject harmful scripts into web pages, which are then executed when other users visit these compromised pages. Publicized on March 12, 2024, by researcher Nikolas - mdr, this vulnerability raises concerns over the plugin's input validation processes and the potential for unauthorized access and data manipulation.

Implications and Risks:

The primary risk associated with CVE-2024-1507 is the unauthorized execution of scripts, leading to possible data breaches, website defacement, or the spread of malware. For businesses relying on WordPress and plugins like Prime Slider, such vulnerabilities can not only disrupt operations but also erode trust among users and customers.

Mitigation and User Guidance:

To counteract this vulnerability, users must upgrade to the latest patched version, 3.13.3, which addresses the security flaw. Additionally, regular monitoring for unusual site behavior or unauthorized content modifications can further safeguard against potential exploits. While the update resolves this specific issue, users might also consider evaluating alternative plugins to ensure their site's security and functionality align with their needs.

Historical Context and Precedence:

This isn't the first time vulnerabilities have been discovered in the Prime Slider plugin; there have been 5 previously recorded issues since March 4, 2022. Each incident underscores the critical importance of continuous vigilance and the prompt application of security patches.

In conclusion, the discovery of CVE-2024-1507 within the Prime Slider plugin serves as a potent reminder of the ever-present threat of cyber vulnerabilities. For small business owners managing WordPress sites, the importance of staying informed about such vulnerabilities cannot be overstated. Regular updates, diligent site monitoring, and a proactive approach to website security are indispensable practices that not only protect digital assets but also preserve the integrity and trustworthiness of online platforms in an increasingly complex cybersecurity landscape.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Prime Slider Vulnerability – Authenticated Stored Cross-Site Scripting via Rubix Widget – CVE-2024-1507 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment