This vulnerability (CVE-2026-48870) is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting (XSS). It affects King Addons for Elementor plugin versions up to 51.1.62. The flaw allows subscriber-level users to inject malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction required, and scope changed. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to partial disclosure of sensitive information, modification of data, and disruption of service availability within the context of the affected web application. The attacker must have subscriber-level privileges and require user interaction to trigger the vulnerability. The scope of impact extends beyond the vulnerable component, affecting other components or users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber privileges and monitoring for suspicious activity related to script injection. Avoid granting unnecessary privileges to users and apply standard web application security best practices relevant to XSS mitigation.