WordPress Plugin Vulnerabilities

Prime Slider – Addons For Elementor < 4.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery

Description

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
bdthemes-prime-slider-lite
Fixed in 4.1.0

References

CVE
CVE-2025-68500
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8571b2-9260-4970-89f6-f711574e0f7c

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
NumeX
Verified
No
WPVDB ID
c30d46f1-d773-4623-a6d1-b90e76dd44b6

Timeline

Publicly Published
2025-12-13 (about 5 months ago)
Added
2026-01-05 (about 4 months ago)
Last Updated
2026-01-05 (about 4 months ago)

Other

Published
Title
Published
2025-11-26
Title
AI ChatBot with ChatGPT and Content Generator by AYS < 2.7.1 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter
Published
2026-01-23
Title
Frontis Blocks < 1.1.7 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
Published
2024-04-24
Title
PDF Invoices & Packing Slips for WooCommerce < 3.8.1 - Unauthenticated Server-Side Request Forgery
Published
2026-02-13
Title
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
Published
2025-12-31
Title
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Server-Side Request Forgery