PLUGIN SECURITY
Is Bdthemes Prime Slider Lite safe?
Create responsive Elementor sliders for hero sections, posts, products and more with powerful Elementor addons and ready-to-use Elementor templates.
What this plugin does
- Slug:
bdthemes-prime-slider-lite - Author: bdthemes
- 100000+ active installs
- 90/100 rating (82 reviews on wordpress.org)
- 6401808 all-time downloads
- On WordPress.org since 2019-10-07
elementor addonelementor-sliderhero sliderimage sliderwoocommerce slider
Maintenance status
- Last updated: 2026-09-03 12:36pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
Known vulnerabilities
17 known CVEs on file for Bdthemes Prime Slider Lite.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] <= 4.4.5 (unfixed) | — | Unknown | < 4.4.5 | 4.4.5 | 2026-08-08 | — |
| CVE-2025-14277 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 4.1.0 | Server-Side Request Forgery (SSRF) | Medium 4.3 | < 4.1.0 | 4.1.0 | 2025-12-17 | — |
| CVE-2025-68500 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 4.1.0 | Server-Side Request Forgery (SSRF) | Medium 4.9 | < 4.1.0 | 4.1.0 | 2025-12-13 | — |
| CVE-2024-12043 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.16.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.16.6 | 3.16.6 | 2025-01-22 | — |
| CVE-2024-8442 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.15.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.15.19 | 3.15.19 | 2024-11-06 | — |
| CVE-2024-5640 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.14.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.14.8 | 3.14.8 | 2024-06-06 | — |
| CVE-2024-3997 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.14.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.14.2 | 3.14.2 | 2024-05-22 | — |
| CVE-2024-4339 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.14.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.14.4 | 3.14.4 | 2024-05-07 | — |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-1730 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.14.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.14.1 | 3.14.1 | 2024-04-19 | — |
| CVE-2024-32681 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.3 | Missing Authorization | High 8.8 | < 3.13.3 | 3.13.3 | 2024-04-17 | — |
| CVE-2024-32682 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.3 | Missing Authorization | High 8.8 | < 3.13.3 | 3.13.3 | 2024-04-17 | — |
| CVE-2024-30186 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 3.13.2 | 3.13.2 | 2024-03-25 | — |
| CVE-2024-1508 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.13.3 | 3.13.3 | 2024-03-12 | — |
| CVE-2024-1507 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.13.4 | 3.13.4 | 2024-03-12 | — |
| CVE-2024-1506 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.13.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.13.2 | 3.13.2 | 2024-03-06 | — |
| CVE-2024-24883 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.11.11 | Missing Authorization | Medium 4.3 | < 3.11.11 | 3.11.11 | 2024-02-05 | — |
| CVE-2023-33999 | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 3.8.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.8.3 | 3.8.3 | 2023-07-18 | — |
| — | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 2.7.0 | Missing Authorization | Medium 6.3 | < 2.7.0 | 2.7.0 | 2022-03-04 | — |
| — | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 2.7.0 | — | Unknown | < 2.7.0 | 2.7.0 | 2022-02-28 | — |
| — | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 2.7.0 | — | Unknown | < 2.7.0 | 2.7.0 | 2022-02-28 | — |
| — | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite] < 4.1.11 | — | Unknown | < 4.1.11 | 4.1.11 | 0000-00-00 | — |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 2.7.0 | 2.7.0 | — | — |
| CVE-2026-4341 | Prime Slider < 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter | — | Unknown | < 4.1.11 | 4.1.11 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ active installs — 98/100 (2037) — max PHP 8.4
- Addon Elements for Elementor (formerly Elementor Addon Elements) — 80000+ active installs — 96/100 (172)
- PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) — 70000+ active installs — 96/100 (361) — max PHP 8.4
- Dynific Addons for Elementor (formerly AnyWhere Elementor) — 70000+ active installs — 96/100 (104)
- Themesflat Addons For Elementor — 40000+ active installs — 40/100 (9)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.