Login Request a demo
RT
Product
RTMKit
by rometheme · last CVE Sep 11, 2026
19
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 3Medium 14Low 0
Severity
All severities19Critical2High3Medium14Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add RTMKit to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-62065
9.9
0%
Nov 6
WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
Affected: through 1.6.5
CVE-2025-30911
9.9
2%
Apr 1
WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability
Affected: through 1.5.4
CVE-2026-84752
8.8
1%
Sep 3
WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
Affected: through 2.1.5
CVE-2026-3425
8.8
1%
May 13
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
Affected: through 2.0.2
CVE-2026-84763
7.1
0%
Sep 3
WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
Affected: through 2.1.5
CVE-2026-5149
6.5
0%
Jun 16
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
Affected: through 2.0.7
CVE-2025-64283
6.5
0%
Oct 29
WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability
Affected: through 1.6.7
CVE-2025-49235
6.5
0%
Jun 6
WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Affected: through 1.6.0
CVE-2024-47626
6.5
0%
Oct 5
WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
Affected: through 1.5.0
CVE-2024-32956
6.5
0%
Apr 24
WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
Affected: through 1.4.1
CVE-2026-8351
6.4
0%
Jul 3
RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
Affected: through 2.0.7
CVE-2025-8609
6.4
0%
Nov 18
RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
Affected: through 1.6.5
CVE-2025-12473
6.1
0%
Mar 11
RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
Affected: through 1.6.8
CVE-2026-62133
5.4
0%
Sep 11
WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Affected: through 2.1.5
CVE-2026-5137
4.3
0%
Jul 3
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
Affected: through 2.0.7
CVE-2026-3426
4.3
0%
May 13
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
Affected: through 2.0.2
CVE-2024-10326
4.3
0%
Mar 8
RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets
Affected: through 1.5.3
CVE-2025-24743
4.3
0%
Jan 27
WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability
Affected: through 1.5.2
CVE-2024-10324
4.3
0%
Jan 24
RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Affected: through 1.5.2
Showing 19