CVE-2025-11997

MEDIUM

Document Pro Elementor - Info Disclosure

Title source: llm
STIX 2.1

Description

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service.

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0032
EPSS Percentile 23.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
ngothoai/Document Pro Elementor – Documentation & Knowledge Base < 1.0.9
Published Nov 11, 2025
Tracked Since Feb 18, 2026