Server-Side Request Forgery Vulnerability in Prime Slider – Addons for Elementor by WordPress

CVE-2025-14277

What is CVE-2025-14277?

The Prime Slider – Addons for Elementor plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 4.0.9. The vulnerability arises through the import_elementor_template AJAX action, enabling authenticated attackers, with subscriber level access or above, to initiate web requests to arbitrary locations. This could lead to potential data exposure or modification from internal services within the web application.

References