What happened (short)

A Cross-Site Scripting (XSS) vulnerability was reported in the WordPress plugin “King Addons for Elementor” affecting versions up to and including 51.1.62. This issue has been assigned CVE-2026-48870 and was publicly documented on 2 June 2026. The vendor released version 51.1.63 that addresses the problem.

XSS vulnerabilities allow untrusted input to be delivered to site visitors or logged-in users as executable script. Because the plugin integrates with Elementor and is used in content/controls, attackers can leverage XSS to steal session cookies, perform actions on behalf of privileged users, install additional malicious scripts, redirect visitors, or deface content.

If your site uses King Addons, prioritise updating to 51.1.63 or later immediately. If you cannot update immediately, apply layered mitigations: restrict who can edit plugin settings or widgets, harden accounts, and monitor for suspicious activity.

Why XSS matters for WordPress sites

• WordPress sites often run many plugins and themes. An XSS in one plugin can be used to pivot to other components.
• Site editors and administrators are attractive targets; social engineering can trick them into executing payloads in the admin area.
• Persistent (stored) XSS can survive site reloads—once injected, the malicious script is served to many visitors automatically.
• Reflected and DOM XSS are useful in phishing campaigns to capture credentials and session tokens.
• When combined with weak credentials or missing multi-factor authentication, XSS can lead to full site compromise.

Given WordPress sites’ business-critical nature, treat XSS in widely used plugins as urgent.

Vulnerability details and context

• Affected software: King Addons for Elementor plugin
• Vulnerable versions: <= 51.1.62
• Patched version: 51.1.63
• CVE: CVE-2026-48870
• Published: 2 June 2026
• Reported by: independent researcher (public disclosure details in vendor advisory)
• Classification: Cross-Site Scripting (XSS)
• CVSSv3 referenced by researchers: 6.5 (Medium)
• Required privilege to initiate: Subscriber (low-privileged user may start an attack flow), but successful exploitation normally requires interaction by a privileged user.

Important nuance: exploitation in many realistic scenarios requires user interaction. An attacker may craft content or a link that, if opened by an editor or admin, results in script execution. This reduces exploitability compared to unauthenticated remote execution but remains a significant risk because targeted social engineering is effective.

How attackers can (and cannot) exploit this issue

Typical XSS attack patterns relevant to WordPress plugins include:

• Stored XSS: Payload is injected into plugin-managed content and then served to other users.
• Reflected XSS: A crafted URL or input causes immediate execution when a user follows the link or submits a form.
• DOM XSS: Client-side JavaScript injects untrusted input into the DOM without sanitization.

What an attacker needs

• Ability to submit or cause storage/reflection of content via the plugin’s interfaces — sometimes a low-privileged authenticated user can do this.
• A target whose browser will render the malicious payload (often an admin/editor).
• User interaction: clicking a crafted link, opening an email, or visiting a specially crafted page.

What an attacker cannot do (without additional flaws)

Remote, unauthenticated, blind full site takeover purely from this vulnerability is less likely unless chained with other issues (CSRF, weak credentials, missing MFA). However, XSS commonly serves as an initial foothold for privilege escalation or backdoor deployment.

Prioritized remediation (what you should do now)

This is a layered, prioritized plan. Follow the steps below in order — from immediate emergency actions to longer-term hardening.

1. Patch immediately (primary mitigation)

• Update King Addons to version 51.1.63 (or later) as soon as possible.
• Test the update in staging if you have customisations, then push to production.
• Use centralised management tools if you maintain many sites to schedule and apply bulk updates.

2. If you cannot update immediately — apply compensating controls

• Enable an application-layer firewall or WAF and ensure it filters POST/GET parameters containing script-like payloads. Enable blocking only after careful testing.
• Temporarily disable or restrict unused plugin features (widgets, modules in Elementor) to reduce the attack surface.
• Restrict who can edit content/widgets — allow only trusted accounts to use Elementor and plugin editing capabilities.
• Turn off untrusted user uploads and sanitise content on submission.

3. Strengthen accounts and access

• Force password resets for administrative users if you suspect compromise.
• Enforce multi-factor authentication (MFA) for administrative and editor accounts.
• Audit user roles; remove unused or suspicious accounts; reduce privileges where not needed.

4. Detect and clean potential compromise

• Run full site malware scans (file integrity and database). Search for injected scripts, base64-encoded files, or unfamiliar PHP files in uploads or theme/plugin directories.
• Scan post content and wp_options for suspicious
  Review My Order

  0

  Subtotal

  Taxes & shipping calculated at checkout

  Checkout