King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting

post_idand areaction`.

$reaction = sanitize_text_field($_POST['reaction'] ?? '');

Wait, if reaction is saved and then displayed... but it's sanitized.

Let's look at Pricing_Table_Builder.php.
It has an AJAX action kng_pt_get_tables.

        add_action('wp_ajax_kng_pt_get_tables', [$this, 'ajax_get_tables']);

Does it check permissions?
If a subscriber can call ajax_get_tables, and then... what?
It probably returns a list of pricing tables.

Let's look at the "Dashboard V3" again. dashboard-v3.php.
There is a "Modules" toggle.

$options = get_option('king_addons_options', []);
// ...
foreach ($widgets as $widget_id => $widget) {
    if (isset($options[$widget_id]) && $options[$widget_id] === 'enabled') {

Is there an AJAX action to enable/disable modules?
In King Addons, there usually is. It's often handled by a generic "save settings" AJAX action.

Wait, I found it! Look at the description of CVE-2023-48870 (Wait, my task says CVE-2026-48870, which is a future date,