What is the CVSS score of CVE-2026-48870?

CVE-2026-48870 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

King Addons CVE-2026-48870

EUVD-2026-36848 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-h543-26jg-7qqc

XSS King Addons For Elementor Elementor

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by Subscriber-level requirement; UI:R for victim browser execution; S:C for cross-context script execution; A:N because XSS does not cause availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:56 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

AnalysisAI

Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the moderate-priority tier despite the network-reachable attack surface.

Technical ContextAI

King Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets and content blocks. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), indicating that user-supplied input is rendered in HTML output without adequate sanitization or escaping. The CPE string cpe:2.3:a:king_addons:king_addons_for_elementor:*:*:*:*:*:*:*:* confirms the vulnerable component is the plugin itself (all sub-versions up to the boundary). In WordPress, Subscriber is the lowest authenticated role, meaning the attack surface is wide - any registered account on a site accepting public registration can be abused. The S:C scope change in the CVSS vector is consistent with stored XSS where payload execution occurs in a different user's browser context rather than the attacker's own.

RemediationAI

Upstream fix availability is not independently confirmed from the provided data - no specific patched version number appears in the references or CPE data. Site operators should immediately check the WordPress plugin repository for a King Addons for Elementor update beyond version 51.1.62 and apply it as soon as one is available. In the interim, if the site does not require public Subscriber registrations, disable open user registration under WordPress Settings > General to eliminate the low-privilege entry point. If Subscriber registration is required, consider a Web Application Firewall (WAF) rule blocking reflected or stored script payloads within plugin widget input fields - noting that WAF rules can cause false positives on legitimate rich-text input. Restricting which user roles can interact with Elementor-powered content areas also reduces exposure. Monitor the Patchstack advisory page at https://patchstack.com/database/wordpress/plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-62-cross-site-scripting-xss-vulnerability for patch release confirmation.