CVE-2026-62133

Unauthenticated Cross Site Scripting (XSS) in RTMKit versions up to 2.1.5. An attacker can inject malicious script without authentication.

Contributor PHP Object Injection in RTMKit versions up to 2.1.5. A user with contributor role can inject malicious PHP objects.

The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.

The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.

The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.

The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.