The Prime Slider – Addons for Elementor plugin suffers from a stored XSS vulnerability due to the 'follow_us_text' setting in the Mount widget being output without proper escaping in the render_social_link() function. The setting is stored in post meta and can be manipulated by authenticated users with Author privileges or higher. This allows injection of arbitrary scripts that execute in the context of users visiting the compromised page. The vulnerability affects all versions up to and including 4.1.10. No patch or official fix has been published as of the data provided.

An authenticated attacker with Author-level access or higher can inject malicious JavaScript into pages via the 'follow_us_text' setting. This script executes in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity at a low level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the vulnerable plugin if feasible. Monitor for updates from the vendor bdthemes regarding patches or temporary mitigations.