What’s Vulnerable › Products

rometheme RTMKit vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your rometheme RTMKit version is affected

Latest rometheme RTMKit vulnerabilities

• CVE-2026-62133 — WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
• CVE-2026-84763 — WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-84752 — WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability (CVSS 8.8)
• CVE-2026-5137 — RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter (CVSS 4.3)
• CVE-2026-8351 — RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter (CVSS 6.4)
• CVE-2026-5149 — RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter (CVSS 6.5)
• CVE-2026-3426 — RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification (CVSS 4.3)
• CVE-2026-3425 — RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' (CVSS 8.8)
• CVE-2025-12473 — RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter (CVSS 6.1)
• CVE-2025-8609 — RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute (CVSS 6.4)
• CVE-2025-62065 — WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability (CVSS 9.9)
• CVE-2025-64283 — WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
• CVE-2025-49235 — WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-30911 — WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability (CVSS 9.9)
• CVE-2025-24743 — WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2024-47626 — WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-32956 — WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)