CVE-2026-8351
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.
Risk Assessment
An attacker can inject a malicious script that executes in the browser of any user visiting the compromised page, potentially leading to session theft, redirects, or data theft.
Recommendation
Immediately update the RTMKit plugin to the latest available version that includes a security fix for this vulnerability.
Other vulnerabilities in RTMKit
See all- CVE-2026-12907Low
The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.
- CVE-2026-12906Low
The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.
- CVE-2026-5137Medium
The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.
Original NVD description (English source)
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.