RT-Theme 18 | Extensions vulnerabilities

The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.

The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.

The RT-Theme 18 | Extensions (rt18-extensions) plugin version 2.5 and earlier contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statement. This allows an attacker to include arbitrary files from the server.

The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.

CSRF vulnerability in RT-Theme 18 | Extensions (rt18-extensions) up to version 2.5 inclusive. Allows Cross-Site Request Forgery.