CVE-2026-4341: Prime Slider for Elementor XSS Vulnerability

CVE-2026-4341 Overview

The Prime Slider – Addons for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the follow_us_text setting of the Mount widget. This flaw affects all versions up to and including 4.1.10 and stems from insufficient input sanitization and output escaping in the plugin's widget rendering functionality.

Critical Impact

Authenticated attackers with Author-level access or above can inject arbitrary JavaScript code that executes whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or defacement.

Affected Products

• Prime Slider – Addons for Elementor plugin for WordPress versions up to and including 4.1.10
• WordPress installations using the vulnerable Mount widget component
• Sites allowing Author-level or higher user registration

Discovery Timeline

• 2026-04-08 - CVE-2026-4341 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-4341

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the Mount widget's social link rendering functionality, where user-controlled input is directly output to the page without proper sanitization.

The vulnerable code path involves the render_social_link() function located in modules/mount/widgets/mount.php. When rendering the Mount widget, this function processes the follow_us_text Elementor widget setting and outputs it directly using PHP's echo statement without applying any escaping functions such as esc_html(), esc_attr(), or wp_kses().

The malicious payload is stored persistently in the WordPress database within the _elementor_data post meta field via the update_post_meta() function. This storage mechanism means the attack payload persists across page loads and affects all visitors who view the compromised page.

Root Cause

The root cause is the absence of output escaping in the render_social_link() function. WordPress and Elementor provide multiple escaping functions designed to prevent XSS attacks, but the developer failed to implement them when outputting the follow_us_text setting value. The vulnerable pattern follows a common anti-pattern where user-supplied widget settings are trusted implicitly and rendered without sanitization.

The setting value flows from user input through Elementor's widget configuration interface, gets stored in the database via update_post_meta(), and is later retrieved and echoed directly to the HTML output without any intermediate sanitization step.

Attack Vector

An authenticated attacker with at least Author-level privileges can exploit this vulnerability by editing a page or post using the Elementor editor, adding the Mount widget, and inserting malicious JavaScript code into the follow_us_text field.

When the page is published and visited by other users (including administrators), the injected script executes in the context of their browser session. This enables various attack scenarios including stealing session cookies, performing actions on behalf of the victim, redirecting users to malicious sites, or modifying page content.

The vulnerability requires network access and authenticated Author-level privileges, but once exploited, the stored payload affects all subsequent visitors to the page without requiring any user interaction beyond viewing the compromised content.

Detection Methods for CVE-2026-4341

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in _elementor_data post meta fields containing Mount widget configurations
• Suspicious script injections within follow_us_text field values in database records
• Unusual network requests originating from pages using the Mount widget
• Reports of browser security warnings or unexpected behavior on pages containing Prime Slider elements

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in Elementor widget settings
• Configure Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Deploy database monitoring to detect unusual patterns in _elementor_data meta field updates
• Use automated vulnerability scanning tools to identify unpatched Prime Slider installations

Monitoring Recommendations

• Enable WordPress audit logging to track Author-level user activities and widget configuration changes
• Monitor HTTP response content for suspicious script patterns on pages using Prime Slider widgets
• Review Elementor widget configurations during regular security audits
• Set up alerts for CSP violation reports indicating potential XSS exploitation attempts

How to Mitigate CVE-2026-4341

Immediate Actions Required

• Update Prime Slider – Addons for Elementor plugin to the latest patched version immediately
• Review existing Mount widget configurations across all pages and posts for suspicious content in the follow_us_text field
• Audit Author-level and above user accounts for any unauthorized or suspicious activity
• Consider temporarily disabling the Mount widget if immediate patching is not possible

Patch Information

The vulnerability was addressed in a plugin update following version 4.1.10. Site administrators should update to the latest available version through the WordPress admin dashboard or by downloading from the official WordPress plugin repository. The WordPress Change Log Entry provides details on the security fix. Additional technical analysis is available from the Wordfence Vulnerability Overview.

Workarounds

• Restrict Author-level and higher user registration to trusted individuals only until patching is complete
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Remove or disable the Mount widget from the Prime Slider plugin settings if it is not actively required
• Deploy a WAF with XSS filtering capabilities to provide an additional layer of protection

# WordPress CLI command to check current plugin version
wp plugin list --name=bdthemes-prime-slider-lite --fields=name,version,update_version

# Update the plugin to latest version via WP-CLI
wp plugin update bdthemes-prime-slider-lite