Rometheme Rtmkit vulnerabilities

• rometheme rtmkit WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-62133 5.4 MediumSeptember 11, 2026
• rometheme rtmkit WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-84763 7.1 HighSeptember 3, 2026
• rometheme rtmkit WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability CVE-2026-84752 8.8 HighSeptember 3, 2026
• rometheme rtmkit RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation CVE-2026-12907 2.7 LowJuly 16, 2026
• rometheme rtmkit RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure CVE-2026-12906 2.7 LowJuly 16, 2026
• rometheme rtmkit RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter CVE-2026-5137 4.3 MediumJuly 3, 2026
• rometheme rtmkit RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter CVE-2026-8351 6.4 MediumJuly 3, 2026
• rometheme rtmkit RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter CVE-2026-5149 6.5 MediumJune 16, 2026
• rometheme rtmkit RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification CVE-2026-3426 4.3 MediumMay 13, 2026
• rometheme rtmkit RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' CVE-2026-3425 8.8 HighMay 13, 2026
• rometheme rtmkit RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter CVE-2025-12473 6.1 MediumMarch 11, 2026
• rometheme rtmkit RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute CVE-2025-8609 6.4 MediumNovember 18, 2025
• rometheme rtmkit WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability CVE-2025-62065 9.9 CriticalNovember 6, 2025
• rometheme rtmkit WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-64283 6.5 MediumOctober 29, 2025
• rometheme rtmkit WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-49235 6.5 MediumJune 6, 2025
• rometheme rtmkit WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability CVE-2025-30911 Public exploit 9.9 CriticalApril 1, 2025
• rometheme romethemekit for elementor, rtmkit +1 more RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets CVE-2024-10326 4.3 MediumMarch 8, 2025
• rometheme rtmkit WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability CVE-2025-24743 4.3 MediumJanuary 27, 2025
• rometheme romethemekit for elementor, rtmkit +1 more RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CVE-2024-10324 4.3 MediumJanuary 24, 2025
• rometheme rtmkit WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-47626 6.5 MediumOctober 5, 2024
• rometheme rtmkit WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-32956 6.5 MediumApril 24, 2024