PT-2026-27061 · Elementor+4 · Elementor+4

Ulyses Saicha · Published 2026-03-23 · Updated 2026-03-23 · CVE-2025-13997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions through 51.1.49

Description The King Addons for Elementor plugin for WordPress is susceptible to unauthenticated disclosure of API keys. The plugin adds API keys to the HTML source code through the render full form function, potentially allowing unauthenticated attackers to extract Mailchimp, Facebook, and Google API keys and secrets. This requires a Premium license to be installed. Reports indicate offensive activities targeting this issue.

Recommendations Versions prior to and including 51.1.49 should be updated.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13997

Affected Products

Elementor

Facebook

Google

Qi Addons For Elementor

Mailchimp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13997 · Security Note
• https://twitter.com/CVEnew/status/2035992464687767915 · Twitter Post
• https://twitter.com/CVEarity/status/2036120386941886522 · Twitter Post
• https://twitter.com/vuldb/status/2036214301758013466 · Twitter Post
• https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve · Note