CVE-2025-13997CWE-200

King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure

Medium · published March 23, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.

This vulnerability requires the Premium license to be installed

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-23T06:41Z
EPSS history
Timeline
  • 23 MAR 06:41Z
    King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure
    cvelistv5