CVE-2025-13997 King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure
Unauthenticated attackers can extract Mailchimp, Facebook, and Google API keys from the HTML source code of the King Addons for Elementor plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13997?
CVE-2025-13997 is a medium-severity vulnerability in kingaddons King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets. This vulnerability requires the Premium license to be installed
Weakness: CWE-200
Which versions are affected by CVE-2025-13997?
How do I fix CVE-2025-13997?
No fix has been published for CVE-2025-13997 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13997 being exploited?
There is no known exploitation of CVE-2025-13997 in the wild and no public exploit code.
Sources
Also known as GHSA-gpcr-p7x3-w57f.