RTMKit
- Software type
- WordPress plugin
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, RTMKit recorded 3 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of RTMKit and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-62133WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-84763WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-84752WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerabilityCVE-2026-8351RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' ParameterCVE-2026-5137RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-62133WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-84763WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-84752WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-8351RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter | Exploitation statusNot exploited | FixYes | Published07/03/2026 | SeverityMedium |
|---|
CVE-2026-5137RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter | Exploitation statusNot exploited | FixYes | Published07/03/2026 | SeverityMedium |
|---|
CVE-2026-5149RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter | Exploitation statusNot exploited | FixYes | Published06/16/2026 | SeverityMedium |
|---|
CVE-2026-3426RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-3425RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2025-12473RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2025-8609RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute | Exploitation statusNot exploited | FixYes | Published11/18/2025 | SeverityMedium |
|---|
CVE-2025-62065WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability | Exploitation statusNot exploited | FixYes | Published11/06/2025 | SeverityCritical |
|---|
CVE-2025-64283WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Published10/29/2025 | SeverityMedium |
|---|
CVE-2025-49235WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published06/06/2025 | SeverityMedium |
|---|
CVE-2025-30911WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability | Exploitation statusNot exploited | FixYes | Published04/01/2025 | SeverityCritical |
|---|
CVE-2024-10326RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets | Exploitation statusNot exploited | FixYes | Published03/08/2025 | SeverityMedium |
|---|
CVE-2025-24743WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published01/27/2025 | SeverityMedium |
|---|
CVE-2024-10324RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates | Exploitation statusNot exploited | FixYes | Published01/24/2025 | SeverityMedium |
|---|
CVE-2024-47626WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published10/05/2024 | SeverityMedium |
|---|
CVE-2024-32956WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published04/24/2024 | SeverityMedium |
|---|
19 Results | Page 1 of 1