Rt18 Extensions Vulnerabilities

The RT-Theme 18 Responsive WordPress Theme plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVSS:

8.1

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Jul 6, 2026

CVE-2026-57743 on NVD →

The RT-Theme 18 Responsive WordPress Theme plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a...

CVSS:

8.1

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Jul 6, 2026

CVE-2026-57744 on NVD →

The RT-Theme 18 Responsive WordPress Theme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Jul 6, 2026

CVE-2026-57745 on NVD →

The RT-Theme 18 Responsive WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Mar 2, 2026

CVE-2026-39711 on NVD →

The RT-Theme 18 | Extensions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted the...

CVSS:

4.3

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Mar 2, 2026

CVE-2026-39710 on NVD →

The RT-Theme 18 | Extensions plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass acce...

CVSS:

9.8

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Jul 28, 2025

CVE-2025-32288 on NVD →