Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-11
RTMKit - Security Vulnerability (CVE-2026-62133)
Subscriber Cross Site Request Forgery (CSRF) in RTMKit
PLUGIN
RTMKit
CVE-2026-62133
Risk Score
Threat Entry
Updated 2026-09-07
RTMKit - Cross-Site Scripting (XSS) (CVE-2026-84763)
Unauthenticated Cross Site Scripting (XSS) in RTMKit
THEME
RTMKit
CVE-2026-84763
Risk Score
Threat Entry
Updated 2026-09-03
RTMKit - PHP Object Injection (CVE-2026-84752)
Contributor PHP Object Injection in RTMKit
THEME
RTMKit
CVE-2026-84752
Risk Score
Threat Entry
Updated 2026-07-16
RTMKit - Broken Access Control (CVE-2026-12907)
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.
PLUGIN
RTMKit
CVE-2026-12907
Risk Score
Threat Entry
Updated 2026-07-16
RTMKit - Broken Access Control (CVE-2026-12906)
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.
PLUGIN
RTMKit
CVE-2026-12906
Risk Score
Threat Entry
Updated 2026-07-06
RTMKit - Path Traversal (CVE-2026-5137)
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.
PLUGIN
RTMKit
CVE-2026-5137
Risk Score
Threat Entry
Updated 2026-07-06
RTMKit - Cross-Site Scripting (XSS) (CVE-2026-8351)
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
RTMKit
CVE-2026-8351
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Broken Access Control (CVE-2026-5149)
The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissions from other users by iterating the entries_id parameter.
PLUGIN
RTMKit
CVE-2026-5149
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Cross-Site Scripting (XSS) (CVE-2025-12473)
The RTMKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'themebuilder' parameter in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link.
THEME
RTMKit
CVE-2025-12473
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Broken Access Control (CVE-2025-64283)
Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through
THEME
RTMKit
CVE-2025-64283
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Cross-Site Scripting (XSS) (CVE-2025-49235)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through
THEME
RTMKit
CVE-2025-49235
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Remote Code Execution (CVE-2025-30911)
Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Command Injection.This issue affects RTMKit: from n/a through
THEME
RTMKit
CVE-2025-30911
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Broken Access Control (CVE-2025-24743)
Missing Authorization vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through
THEME
RTMKit
CVE-2025-24743
Risk Score
Threat Entry
Updated 2026-06-17
RTMKit - Cross-Site Scripting (XSS) (CVE-2024-32956)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through
THEME
RTMKit
CVE-2024-32956
Risk Score