Rometheme For Elementor Vulnerabilities

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitizatio...

CVSS:

4.3

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

Jul 2, 2026

CVE-2026-5137 on NVD →

The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value d...

CVSS:

6.4

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

Jul 2, 2026

CVE-2026-8351 on NVD →

The RTMKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract private post titles.

CVSS:

4.3

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Jun 25, 2026

CVE-2026-12906 on NVD →

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with author-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Jun 25, 2026

CVE-2026-12907 on NVD →

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authentica...

CVSS:

6.5

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

Jun 15, 2026

CVE-2026-5149 on NVD →

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary PHP f...

CVSS:

8.8

Affected:

up to 2.0.2

Fixed in:

2.0.3

Disclosed:

May 12, 2026

CVE-2026-3425 on NVD →

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Author-level access and ab...

CVSS:

4.3

Affected:

up to 2.0.2

Fixed in:

2.0.3

Disclosed:

May 12, 2026

CVE-2026-3426 on NVD →

Reflected Cross-Site Scripting via 'themebuilder' Parameter vulnerability

CVSS:

7.1

Affected:

up to 1.6.8

Fixed in:

2.0.0

Disclosed:

Mar 11, 2026

The RTMKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'themebuilder' parameter in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...

CVSS:

6.1

Affected:

up to 1.6.8

Fixed in:

2.0.0

Disclosed:

Mar 10, 2026

CVE-2025-12473 on NVD →

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att...

CVSS:

6.4

Affected:

up to 1.6.5

Fixed in:

1.6.6

Disclosed:

Nov 17, 2025

CVE-2025-8609 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5.

Affected:

up to 1.6.5

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-62065 on NVD →

[en] Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through <= 1.6.7.

Affected:

up to 1.6.7

Fix:

No patched version reported

Disclosed:

Oct 29, 2025

CVE-2025-64283 on NVD →

The RTMKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make rem...

CVSS:

8.8

Affected:

up to 1.6.5

Fixed in:

1.6.6

Disclosed:

Oct 18, 2025

CVE-2025-62065 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit Addons for Elementor allows Stored XSS. This issue affects RTMKit Addons for Elementor: from n/a through 1.6.0.

Affected:

up to 1.6.1

Fixed in:

1.6.1

Disclosed:

Jun 6, 2025

CVE-2025-49235 on NVD →

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip...

CVSS:

6.4

Affected:

up to 1.6.0

Fixed in:

1.6.1

Disclosed:

Jun 5, 2025

CVE-2025-49235 on NVD →

[en] Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RomethemeKit For Elementor allows Command Injection. This issue affects RomethemeKit For Elementor: from n/a through 1.5.4.

Affected:

up to 1.5.5

Fixed in:

1.5.5

Disclosed:

Apr 1, 2025

CVE-2025-30911 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins on the affected site...

CVSS:

8.8

Affected:

up to 1.5.4

Fixed in:

1.5.5

Disclosed:

Mar 27, 2025

CVE-2025-30911 on NVD →

[en] The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and...

Affected:

up to 1.5.4

Fixed in:

1.5.4

Disclosed:

Mar 8, 2025

CVE-2024-10326 on NVD →

The RTMKit plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.7 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.6.7

Fixed in:

1.6.8

Disclosed:

Feb 14, 2025

CVE-2025-64283 on NVD →

[en] Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor. This issue affects RomethemeKit For Elementor: from n/a through 1.5.2.

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Jan 27, 2025

CVE-2025-24743 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Jan 24, 2025

CVE-2025-24743 on NVD →

[en] The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extr...

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Jan 24, 2025

CVE-2024-10324 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract s...

CVSS:

4.3

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Jan 23, 2025

CVE-2024-10324 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVSS:

4.3

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Jan 14, 2025

CVE-2024-10326 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rometheme RomethemeKit For Elementor allows Stored XSS.This issue affects RomethemeKit For Elementor: from n/a through 1.5.0.

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Oct 5, 2024

CVE-2024-47626 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 1.5.0

Fixed in:

1.5.1

Disclosed:

Sep 30, 2024

CVE-2024-47626 on NVD →

[en] Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

May 3, 2024

CVE-2024-33919 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addNewPost() function in versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to add new posts.

CVSS:

5.3

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Apr 29, 2024

CVE-2024-33919 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RomethemeKit For Elementor allows Stored XSS.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Apr 24, 2024

CVE-2024-32956 on NVD →

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above...

CVSS:

6.4

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Apr 22, 2024

CVE-2024-32956 on NVD →