Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the `render_social_link()` function in `modules/mount/widgets/mount.php` outputs the `follow_us_text` Elementor widget setting using `echo` without any escaping function. The setting value is stored in `_elementor_data` post meta via `update_post_meta`. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-4341: Stored Cross-Site Scripting in Prime Slider Addons for Elementor - What It Means for Your Business and How to Respond https://hubs.li/Q04pf_tX0
Post summary
The article announces CVE‑2026‑4341, a stored XSS in a Elementor add‑on, without providing PoC, exploit code, or patch details.
CVE-2026-4341 The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all ve… https://www.cve.org/CVERecord?id=CVE-2026-4341
Post summary
The text announces a stored XSS vulnerability (CVE-2026-4341) in the Prime Slider Elementor plugin, describing the affected setting but lacking any PoC, exploit code, active exploitation, patch information, or false‑positive claim.
CVE-2026-4341 Stored Cross-Site Scripting in Prime Slider Elementor Plugin Versions Up To 4.1.10 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4341
Post summary
The post announces a stored XSS vulnerability (CVE‑2026‑4341) in Prime Slider Elementor Plugin up to version 4.1.10, but provides no PoC, exploit, active exploitation, or patch details.