CVE-2025-13997

Medium CVSS: 5.3

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.
This vulnerability requires the Premium license to be installed

Vendor

Product

CWE

CWE-200

Yayın Tarihi

2026-03-23 07:16:05

Güncelleme

2026-03-23 14:31:37

Source Identifier

security@wordfence.com

KEV Date Added

Kategoriler

CWE-200 MEDIUM 2026

Referanslar

https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065 https://www.wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve