Advisories · Technology
rometheme RTMKit.
Every CVE that names rometheme RTMKit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- rometheme RTMKit
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
- rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 8.8 High
WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
- rometheme RTMKit
- Insecure deserialization
- CVSS 4.3 Medium
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
- rometheme RTMKit
- File inclusion
- CVSS 6.4 Medium
RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
- rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
- rometheme RTMKit
- Broken access control
- CVSS 4.3 Medium
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
- rometheme RTMKit
- Broken access control
- CVSS 8.8 High
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
- rometheme RTMKit
- File inclusion
- CVSS 6.1 Medium
RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
- rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
- rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
- Rometheme RTMKit
- Unrestricted file upload
- CVSS 6.5 Medium
WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability
- Rometheme RTMKit
- Broken access control
- CVSS 6.5 Medium
WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
- Rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability
- Rometheme RTMKit
- Code injection
- CVSS 4.3 Medium
RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets
- rometheme RTMKit
- Broken access control
- CVSS 4.3 Medium
WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability
- Rometheme RTMKit
- Broken access control
- CVSS 4.3 Medium
RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
- rometheme RTMKit
- CWE-1230
- CVSS 6.5 Medium
WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
- Rometheme RTMKit
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
- Rometheme RTMKit
- Cross-site scripting (XSS)