Skip to main content

King Addons CVE-2026-48870

| EUVD-2026-36848 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-06-15 Patchstack GHSA-h543-26jg-7qqc
XSS King Addons For Elementor Elementor
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
5.4 MEDIUM

PR:L confirmed by Subscriber-level requirement; UI:R for victim browser execution; S:C for cross-context script execution; A:N because XSS does not cause availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jun 15, 2026 - 22:56 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

AnalysisAI

Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Register or obtain Subscriber account
Delivery
Locate vulnerable King Addons widget input field
Exploit
Submit crafted XSS payload via plugin widget
Install
Payload stored in WordPress database
C2
Privileged user views affected page
Execute
Injected script executes in victim browser
Impact
Session token exfiltrated or admin action triggered
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold at minimum a WordPress Subscriber-level authenticated account on the target site - either through public user registration being enabled, or by obtaining credentials via other means. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS base score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L reflects a medium-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a Subscriber account on a WordPress site with open registration and King Addons for Elementor installed at version 51.1.62 or earlier. The attacker locates a plugin widget that accepts and stores user-supplied input without sanitization, and submits a crafted payload containing a malicious JavaScript snippet. …
Remediation Upstream fix availability is not independently confirmed from the provided data - no specific patched version number appears in the references or CPE data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-48870 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy