CVE-2025-13997

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13997", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T22:19:22.746Z", "datePublished": "2026-03-23T06:41:08.390Z", "dateUpdated": "2026-04-08T17:02:09.847Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:09.847Z"}, "affected": [{"vendor": "kingaddons", "product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "51.1.49", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor \u2013 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.\r\nThis vulnerability requires the Premium license to be installed"}], "title": "King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ulyses Saicha"}], "timeline": [{"time": "2025-11-20T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-22T18:29:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T11:35:36.235773Z", "id": "CVE-2025-13997", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T11:35:45.664Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13997", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T11:35:36.235773Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T11:35:41.377Z"}}], "cna": {"title": "King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Ulyses Saicha"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "kingaddons", "product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "51.1.49"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-20T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-22T18:29:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065"}], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor \u2013 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.\r\nThis vulnerability requires the Premium license to be installed"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-23T06:41:08.390Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13997", "state": "PUBLISHED", "dateUpdated": "2026-03-23T11:35:45.664Z", "dateReserved": "2025-12-03T22:19:22.746Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-23T06:41:08.390Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "vendor": "kingaddons", "versions": [{"lessThanOrEqual": "51.1.49", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor \u2013 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.\r\nThis vulnerability requires the Premium license to be installed"}, {"lang": "es", "value": "Los King Addons para Elementor \u2013 m\u00e1s de 4.000 secciones de Elementor listas, m\u00e1s de 650 plantillas, m\u00e1s de 70 widgets GRATUITOS para el plugin Elementor para WordPress es vulnerable a la divulgaci\u00f3n de claves API no autenticadas en todas las versiones hasta la 51.1.49, inclusive, debido a que el plugin a\u00f1ade las claves API al c\u00f3digo fuente HTML a trav\u00e9s de la funci\u00f3n render_full_form. Esto hace posible que atacantes no autenticados extraigan las claves y secretos API de Mailchimp, Facebook y Google del sitio. Esta vulnerabilidad requiere que la licencia Premium est\u00e9 instalada."}], "id": "CVE-2025-13997", "lastModified": "2026-06-17T08:35:08.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13997", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T11:35:36.235773Z", "version": "2.0.3"}}]}, "published": "2026-03-23T07:16:05.003", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,51.1.49]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "source": "cna", "vendor": "kingaddons"}, "product": "king_addons_for_elementor_\u2013_80+_elementor_widgets,_4_000+_elementor_templates,_woocommerce,_mega_menu,_popup_builder", "vendor": "kingaddons"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-23T07:20:43.775114+00:00", "value": {"mitigation_remediation": ["Upgrade King Addons for Elementor to version 51.1.50 or newer", "Verify that no Mailchimp, Facebook, or Google API keys appear in page source after the upgrade", "If an upgrade is not immediately possible, disable or remove the plugin until a fix is released", "Monitor the site for unexpected activity that could indicate compromise of exposed credentials"], "summary": {"action": "Patch", "impact": "Credential disclosure via exposed API keys"}, "threat_synthesis": {"affected_systems": "All versions of King Addons for Elementor up to and including 51.1.49 are affected. The flaw only manifests when the Premium license is installed. Normal users of earlier versions or without the premium edition are not impacted.", "description_and_impact": "The King Addons for Elementor plugin contains a flaw that allows attackers without authentication to read API keys and secrets for Mailchimp, Facebook, and Google that are inserted into webpage source code. This vulnerability is classified as a credential disclosure issue (CWE\u2011200) and could enable an attacker to abuse those keys for unauthorized actions such as sending spam, extracting sensitive data, or accessing third\u2011party services linked to the affected site.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely carried out by an unauthenticated user who fetches page source; no special privileges or pre\u2011existing conditions are required beyond accessing the site. Given the lack of exploitation evidence, the likelihood of a widespread attack remains uncertain, but the potential impact warrants prompt attention."}}}}, "created": "2026-03-23T09:45:13.597893+00:00", "updated": "2026-03-25T14:49:35.040578+00:00", "vendors": ["kingaddons", "kingaddons$PRODUCT$king_addons_for_elementor_\u2013_80+_elementor_widgets,_4_000+_elementor_templates,_woocommerce,_mega_menu,_popup_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}