CVE-2026-4341
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.
Risk Assessment
The risk includes potential malicious script execution on pages, leading to session data theft, defacement, or further attacks on users.
Recommendation
Update the Prime Slider plugin to a version above 4.1.10 that includes the security fix.
Original NVD description (English source)
The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the `render_social_link()` function in `modules/mount/widgets/mount.php` outputs the `follow_us_text` Elementor widget setting using `echo` without any escaping function. The setting value is stored in `_elementor_data` post meta via `update_post_meta`. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.