What is the CVSS score of CVE-2026-4341?

CVE-2026-4341 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-4341

EUVD-2026-20046 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-p356-q857-c7qx

PHP WordPress XSS Prime Slider Addons For Elementor Wordpress Plugin Bdthemes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20046

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 03:36 nvd

MEDIUM 6.4

DescriptionCVE.org

The Prime Slider - Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the render_social_link() function in modules/mount/widgets/mount.php outputs the follow_us_text Elementor widget setting using echo without any escaping function. The setting value is stored in _elementor_data post meta via update_post_meta. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Prime Slider - Addons for Elementor plugin allows authenticated users with Author-level access to inject arbitrary JavaScript through the 'follow_us_text' setting in the Mount widget. The vulnerability exists in all versions up to 4.1.10 due to missing output escaping in the render_social_link() function, enabling attackers to execute malicious scripts whenever pages containing the injected widget are viewed. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability resides in the Prime Slider - Addons for Elementor WordPress plugin (BDThemes) and affects the Mount widget component. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the render_social_link() function located in modules/mount/widgets/mount.php. The function directly outputs the 'follow_us_text' Elementor widget setting using PHP's echo statement without applying WordPress escaping functions such as wp_kses_post() or esc_html(). The malicious payload is stored in the _elementor_data post meta through update_post_meta() and persists in the database. When a page containing the compromised Mount widget is rendered, the unescaped JavaScript executes in the context of any user's browser visiting that page, including administrators.

RemediationAI

Update the Prime Slider - Addons for Elementor plugin to version 4.1.11 or later, which contains patches that add proper output escaping to the render_social_link() function. Users can verify the vulnerability by checking the Mount widget code at modules/mount/widgets/mount.php line 230 and line 1027; if follow_us_text is output with echo instead of an escaping function, the installation is vulnerable. WordPress administrators should also audit existing Mount widget instances for suspicious JavaScript in the 'follow_us_text' setting values stored in _elementor_data post meta and remove any malicious content. For sites unable to immediately patch, restricting Author-level role creation and auditing existing Author accounts can reduce exposure. Wordfence provides additional mitigation details in their advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2ef416-4354-4e09-b9be-e36c1f655110?source=cve.