PT-2026-27061 · Kingaddons · King Addons For Elementor – 80+ Elementor Widgets

Ulyses Saicha · Published 2026-03-23 · Updated 2026-03-23 · CVE-2025-13997

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render full form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets. This vulnerability requires the Premium license to be installed

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13997

Affected Products

King Addons For Elementor – 80+ Elementor Widgets

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-13997 · Security Note
• https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve · Note