Prime Slider – Addons for Elementor is vulnerable to stored cross‑site scripting through the follow_us_text setting in the Mount widget. The plugin fails to sanitize or escape this setting when outputting it, allowing an authenticated user with Author level or higher to inject arbitrary JavaScript into the widget’s output. Once stored, the script runs whenever a page containing the widget is viewed, potentially exposing data or controlling the user session.

All WordPress installations running Prime Slider – Addons for Elementor up to and including version 4.1.10 are affected due to the render_social_link() function in modules/mount/widgets/mount.php.

The CVSS score is 6.4 and the vulnerability is not listed in KEV, indicating no widespread exploitation to date. An attacker must first authenticate to the WordPress admin interface with at least Author access to modify the widget setting. After injecting malicious code, the attacker can achieve client‑side script execution on any user that views the affected page. While there is no publicly documented exploit, the lack of input validation makes the vulnerability readily exploitable by anyone who can reach the editor.