PT-2026-31081 · Bdthemes · The Prime Slider – Addons For Elementor

Athiwat Tiprasaharn + 1 · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-4341

Mitre

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow us text' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the render social link() function in modules/mount/widgets/mount.php outputs the follow us text Elementor widget setting using echo without any escaping function. The setting value is stored in elementor data post meta via update post meta. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4341

Affected Products

The Prime Slider – Addons For Elementor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4341 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3493676%40bdthemes-prime-slider-lite&new=3493676%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/trunk/modules/mount/widgets/mount.php#L230 · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.1.9/modules/mount/widgets/mount.php#L230 · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.1.9/modules/mount/widgets/mount.php#L1027 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4a2ef416-4354-4e09-b9be-e36c1f655110?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/trunk/modules/mount/widgets/mount.php#L1027 · Note