EUVD-2026-41512
GHSA-cvjh-fmg7-m8wm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS still requires a victim to navigate to the injected page (UI:R); PR:L reflects mandatory contributor account; S:C correct as payload executes in victim browser principal.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled background_text_heading setting into an HTML attribute inside the widget's render() function without applying WordPress's esc_attr() sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.
Technical ContextAI
RTMKit (WordPress plugin slug: rometheme-for-elementor, vendor: RomeTheme) is an Elementor widget extension for WordPress. The vulnerability resides in Inc/Elements/AdvancedHeading.php - specifically in the render() function at lines 133 and 960 (per trac source references), where the background_text_heading setting value is concatenated directly into an HTML attribute string without invoking esc_attr() or any equivalent output encoding function. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) is the root cause class: a classic output encoding omission at the server-side template rendering layer. Because the payload is written to the database during widget save and replayed to every page visitor, this is a stored (persistent) XSS rather than reflected. The CPE string cpe:2.3:a:rometheme:rtmkit:*:*:*:*:*:*:*:* covers all versions through 2.0.7.
RemediationAI
Update the RTMKit (rometheme-for-elementor) plugin to version 2.0.8 or later, which addresses the missing esc_attr() call in the Advanced Heading widget's render() function; the fix is evidenced by the trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8. Note that 2.0.8 as the patched version is inferred from the trac diff and has not been confirmed by a separately published vendor security advisory - verify the changelog after updating. As a compensating control before patching, restrict the WordPress contributor role to fully trusted internal users and disable open user registration if enabled; this prevents unauthenticated attackers from self-registering to reach the contributor access threshold, though it will affect normal editorial workflows. Alternatively, temporarily deactivate the RTMKit plugin if the Advanced Heading widget is not operationally required, accepting the trade-off of lost Elementor widget functionality.
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted build
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows an
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today