PT-2025-46269 · WordPress+1 · Document Pro Elementor – Documentation & Knowledge Base+1

Nabil Irawan · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress versions prior to 1.1.0

Description The plugin exposes sensitive Algolia API keys through the frontend JavaScript code via wp localize script without proper access restrictions. This allows unauthenticated attackers to view these API keys in the page source, potentially enabling unauthorized API calls to the configured Algolia search service.

Recommendations Update the Document Pro Elementor – Documentation & Knowledge Base plugin to version 1.1.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-11997

Affected Products

Algolia

Document Pro Elementor – Documentation & Knowledge Base

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11997 · Security Note
• https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L71 · Note
• https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L85 · Note
• https://twitter.com/CVEnew/status/1988095329728712752 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4?source=cve · Note