rometheme RTMKit vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20258
3. 20269

Newest CVEs

• CVE-2026-62133

  WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

  rometheme · RTMKit

  Medium5.4
• CVE-2026-84763

  WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

  rometheme · RTMKit

  High7.1
• CVE-2026-84752

  WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

  rometheme · RTMKit

  High8.8
• CVE-2026-5137

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter

  rometheme · RTMKit

  Medium4.3
• CVE-2026-8351

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter

  rometheme · RTMKit

  Medium6.4
• CVE-2026-5149

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter

  rometheme · RTMKit

  Medium6.5
• CVE-2026-3426

  RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification

  rometheme · RTMKit

  Medium4.3
• CVE-2026-3425

  RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'

  rometheme · RTMKit

  High8.8
• CVE-2025-12473

  RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter

  rometheme · RTMKit

  Medium6.1
• CVE-2025-8609

  RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute

  rometheme · RTMKit

  Medium6.4