Is CVE-2026-111111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111111 being exploited in the wild.

How severe is CVE-2026-111111?

High severity, with a CVSS score of 7.2, published 28 October 2026.

Which products and versions are affected?

BdThemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons up to and including 4.7.2.

Is there a fix for CVE-2026-111111?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111111 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111111?

Check whether you run BdThemes Prime Slider – Hero Slider, Carousel or WooCommerce & Post Slider Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111111: BDThemes Prime Slider stored cross-site scripting via comment parameter

CVE-2026-111111 · Severity: high · CVSS 7.2 · Published 2026-10-28

The Prime Slider plugin for WordPress allows attackers to inject malicious scripts that execute when website visitors view affected pages. Unauthenticated attackers can exploit insufficient input sanitization in the comment parameter to inject code that persists in the database, affecting any user who subsequently accesses the injected content. This can lead to credential theft, malware distribution, or defacement of the website.

Vendors: BdThemes.

Quick answers

Is CVE-2026-111111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111111 being exploited in the wild.
How severe is CVE-2026-111111?: High severity, with a CVSS score of 7.2, published 28 October 2026.
Which products and versions are affected?: BdThemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons up to and including 4.7.2.
Is there a fix for CVE-2026-111111?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111111 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111111?: Check whether you run BdThemes Prime Slider – Hero Slider, Carousel or WooCommerce & Post Slider Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw caused by inadequate input sanitization and output escaping of the comment parameter. An attacker can bypass the plugin's sanitization logic by crafting input that exploits how the plugin's regex fallback processes closing quotes in attribute values containing 'bdt-', converting previously inert markup into executable HTML attributes like event handlers. The malicious payload is stored in the database and executed in the context of any user viewing the affected page.

Affected products

BDThemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons up to and including 4.7.2

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.