How severe is CVE-2025-13997?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Kingaddons King Addons For Elementor – 80+ Widgets, 4 000+ Templates, Woocommerce, Mega Menu, Popup Builder

CVE-2025-13997

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets. This vulnerability requires the Premium license to be installed

Vulnerability class: Information Disclosure

EPSS: 0.002 (12.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Kingaddons King Addons For Elementor – 80+ Widgets, 4 000+ Templates, Woocommerce, Mega Menu, Popup Builder — versions 0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

Frequently asked questions

What is CVE-2025-13997?: CVE-2025-13997 is a medium-severity vulnerability in Kingaddons King Addons For Elementor – 80+ Widgets, 4 000+ Templates, Woocommerce, Mega Menu, Popup Builder, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-03-23.
How severe is CVE-2025-13997?: Medium severity. CVSS v3 base score is 5.3 out of 10.