This vulnerability (CVE-2026-48870) affects King Addons for Elementor plugin versions <= 51.1.62. It is a CWE-79 type cross-site scripting (XSS) flaw where subscriber users can inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected web application. This can lead to partial compromise of confidentiality, integrity, and availability of the application or user data. The scope of impact extends beyond the vulnerable component, indicating potential broader effects within the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber input capabilities or applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.