What is the CVSS score of EUVD-2026-41512?

EUVD-2026-41512 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

RTMKit WordPress Plugin EUVD-2026-41512

| CVE-2026-8351 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-03 Wordfence

GHSA-cvjh-fmg7-m8wm

WordPress XSS Wordpress Plugin Rtmkit Rometheme

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS still requires a victim to navigate to the injected page (UI:R); PR:L reflects mandatory contributor account; S:C correct as payload executes in victim browser principal.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 08:22 vuln.today

CVE Published

Jul 03, 2026 - 06:50 nvd

MEDIUM 6.4

DescriptionCVE.org

The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled background_text_heading setting into an HTML attribute inside the widget's render() function without applying WordPress's esc_attr() sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.

Technical ContextAI

RTMKit (WordPress plugin slug: rometheme-for-elementor, vendor: RomeTheme) is an Elementor widget extension for WordPress. The vulnerability resides in Inc/Elements/AdvancedHeading.php - specifically in the render() function at lines 133 and 960 (per trac source references), where the background_text_heading setting value is concatenated directly into an HTML attribute string without invoking esc_attr() or any equivalent output encoding function. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) is the root cause class: a classic output encoding omission at the server-side template rendering layer. Because the payload is written to the database during widget save and replayed to every page visitor, this is a stored (persistent) XSS rather than reflected. The CPE string cpe:2.3:a:rometheme:rtmkit:*:*:*:*:*:*:*:* covers all versions through 2.0.7.

RemediationAI

Update the RTMKit (rometheme-for-elementor) plugin to version 2.0.8 or later, which addresses the missing esc_attr() call in the Advanced Heading widget's render() function; the fix is evidenced by the trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8. Note that 2.0.8 as the patched version is inferred from the trac diff and has not been confirmed by a separately published vendor security advisory - verify the changelog after updating. As a compensating control before patching, restrict the WordPress contributor role to fully trusted internal users and disable open user registration if enabled; this prevents unauthenticated attackers from self-registering to reach the contributor access threshold, though it will affect normal editorial workflows. Alternatively, temporarily deactivate the RTMKit plugin if the Advanced Heading widget is not operationally required, accepting the trade-off of lost Elementor widget functionality.