Prime Slider - Addons for Elementor Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Prime Slider - Addons for Elementor plugin for WordPress, affecting all versions through 4.1.10. The issue arises in the Mount widget, where the 'follow_us_text' setting is output without proper sanitization or escaping. This flaw allows authenticated attackers with Author-level access or higher to inject malicious scripts that are executed when users view the affected page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can inject a script into the 'follow_us_text' parameter of the Mount widget. This script will be executed when the page is accessed.

Remediation

Users are advised to update the Prime Slider - Addons for Elementor plugin to version 4.1.11 or later.