[Mehmet S.]

Prime Slider is temporarily closed on the WordPress.org plugin repository, pending review. A number of Pixelwars themes recommend it and use it in their demo designs.

—

**Installing Prime Slider right now**

The plugin author has published a fixed free version on their own site, so you don’t need to wait for the repository to reopen.

1. Go to https://primeslider.pro/pricing/ and click the “Free Download” button at the bottom of the Free column. This is the plugin author’s own official site rather than a third-party mirror, and I downloaded and reviewed the file myself before recommending it here.

2. In your WordPress admin, go to Plugins > Add New > Upload Plugin, select the ZIP, then install and activate it.

3. Open the “Prime Slider” menu and go to the “Core Widgets” page. Click “Activate All”, then “Save Settings”. Not all widgets are enabled by default, and demo content won’t render correctly without this step.

4. Run your theme’s demo import. If you have already imported, there’s no need to repeat it — the slider sections will render once steps 1 to 3 are done.

—

**If you already had Prime Slider installed**

The repository closure follows a security incident. Attackers gained write access to the remote feed that Prime Slider used for admin banners, which allowed malicious code to run in the browser of any logged-in administrator. No plugin files on WordPress.org were modified. The reported outcome was hidden administrator accounts and webshells.

Sites that had the plugin active between late June and August 8, 2026 may have been exposed.

Worth checking:

– Administrator accounts you don’t recognise
– Files in wp-content/mu-plugins
– A file named emer-run.php
– Unfamiliar files matching class-wp-query-*
– A database option named fz_emer_login_tokens

If you find any of these, treat the site as compromised: remove the unknown accounts and files, change all administrator passwords, rotate your security keys and salts, and run a full malware scan. A service such as Wordfence or Sucuri can do this for you. If you find nothing, update to the current version and keep an eye on your administrator list.

In the version now published by the plugin author, the component behind this issue has been disabled and the vulnerability patched.

—

**Two notes**

Pixelwars has never bundled or distributed this plugin. Our themes list it as a recommended plugin you install yourself. Please don’t install it from any unofficial or “nulled” download site.

The plugin author now trades as Sigmative LLC. It is the same company.

We have no date for the repository listing reopening. We’re monitoring it and will update this page when it does. If anything here is unclear, post in your theme’s support forum and I’ll help.

Best regards,
Mehmet
Pixelwars