Rometheme
Monthly
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the RTMKit WordPress plugin (versions ≤ 2.1.5) allows an authenticated Contributor-level user to pass a crafted serialized PHP payload through a vulnerable plugin input, triggering deserialization of untrusted data. In plugin-rich WordPress environments where PHP gadget chains are commonly available, this escalates to remote code execution, full database access, and file system compromise. No confirmed active exploitation or public exploit code has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 allows authenticated attackers with Contributor-level access to include and execute arbitrary PHP code on the server. The render_templates AJAX endpoint passes the unsanitized 'template' parameter directly into a PHP require/include statement, restricted only to files ending in _templates.php. Wordfence reported this vulnerability; no public exploit code or CISA KEV listing is present at time of analysis.
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled `background_text_heading` setting into an HTML attribute inside the widget's `render()` function without applying WordPress's `esc_attr()` sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows any Contributor-level WordPress user to read arbitrary form submissions belonging to other users. The root cause is a missing capability check on the get_submission_content AJAX endpoint, enabling horizontal privilege escalation across all stored form entries by iterating numeric entry IDs. No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation is mechanically trivial for any authenticated user; sites collecting sensitive PII or business data via RTMKit forms should treat this as high operational priority despite the medium CVSS score.
RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers with Author-level access or higher to modify or reset site-wide widget configurations due to missing capability checks in the save_widget() and reset_all_widgets() functions. This privilege escalation vulnerability affects all versions up to 2.0.2 and enables unauthorized modification of widget data across the entire WordPress site, impacting site integrity and user experience.
Local File Inclusion vulnerability in RTMKit Addons for Elementor plugin versions up to 2.0.2 allows authenticated attackers with Author-level privileges to include and execute arbitrary PHP files via the 'path' parameter in the 'get_content' AJAX action, enabling remote code execution. The vulnerability requires low-privilege WordPress account access (Author role or higher) and has a CVSS score of 8.8, indicating high impact across confidentiality, integrity, and availability. EPSS data not available, but exploitation requires specific WordPress role assignment, limiting attack surface to sites where untrusted users have Author-level access. No active exploitation confirmed by CISA KEV at time of analysis.
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the RTMKit WordPress plugin (versions ≤ 2.1.5) allows an authenticated Contributor-level user to pass a crafted serialized PHP payload through a vulnerable plugin input, triggering deserialization of untrusted data. In plugin-rich WordPress environments where PHP gadget chains are commonly available, this escalates to remote code execution, full database access, and file system compromise. No confirmed active exploitation or public exploit code has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 allows authenticated attackers with Contributor-level access to include and execute arbitrary PHP code on the server. The render_templates AJAX endpoint passes the unsanitized 'template' parameter directly into a PHP require/include statement, restricted only to files ending in _templates.php. Wordfence reported this vulnerability; no public exploit code or CISA KEV listing is present at time of analysis.
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled `background_text_heading` setting into an HTML attribute inside the widget's `render()` function without applying WordPress's `esc_attr()` sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows any Contributor-level WordPress user to read arbitrary form submissions belonging to other users. The root cause is a missing capability check on the get_submission_content AJAX endpoint, enabling horizontal privilege escalation across all stored form entries by iterating numeric entry IDs. No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation is mechanically trivial for any authenticated user; sites collecting sensitive PII or business data via RTMKit forms should treat this as high operational priority despite the medium CVSS score.
RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers with Author-level access or higher to modify or reset site-wide widget configurations due to missing capability checks in the save_widget() and reset_all_widgets() functions. This privilege escalation vulnerability affects all versions up to 2.0.2 and enables unauthorized modification of widget data across the entire WordPress site, impacting site integrity and user experience.
Local File Inclusion vulnerability in RTMKit Addons for Elementor plugin versions up to 2.0.2 allows authenticated attackers with Author-level privileges to include and execute arbitrary PHP files via the 'path' parameter in the 'get_content' AJAX action, enabling remote code execution. The vulnerability requires low-privilege WordPress account access (Author role or higher) and has a CVSS score of 8.8, indicating high impact across confidentiality, integrity, and availability. EPSS data not available, but exploitation requires specific WordPress role assignment, limiting attack surface to sites where untrusted users have Author-level access. No active exploitation confirmed by CISA KEV at time of analysis.
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.