Extension WordPress
Vulnérabilités RTMKit
Cette page rassemble les failles publiées pour RTMKit, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de RTMKit
17 fiches
RTMKit <= 2.0.7 – Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used…
*-2.0.7
2.0.8
02/07/2026
RTMKit <= 2.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in…
*-2.0.7
2.0.8
02/07/2026
RTMKit <= 2.0.7 – Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to…
*-2.0.7
2.0.8
15/06/2026
RTMKit Addons for Elementor <= 2.0.2 – Authenticated (Author+) Missing Authorization to Widget Configuration Modification
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible…
*-2.0.2
2.0.3
12/05/2026
RTMKit Addons for Elementor <= 2.0.2 – Authenticated (Author+) Local File Inclusion via 'path'
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers,…
*-2.0.2
2.0.3
12/05/2026
RTMKit <= 1.6.8 – Reflected Cross-Site Scripting via 'themebuilder' Parameter
The RTMKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'themebuilder' parameter in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-1.6.8
2.0.0
10/03/2026
RTMKit Addons <= 1.6.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user…
*-1.6.5
1.6.6
17/11/2025
RTMKit <= 1.6.5 – Authenticated (Contributor+) Arbitrary File Upload
The RTMKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to…
*-1.6.5
1.6.6
18/10/2025
RTMKit Addons for Elementor <= 1.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
*-1.6.0
1.6.1
05/06/2025
RomethemeKit For Elementor <= 1.5.4 – Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
The RomethemeKit For Elementor plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and…
*-1.5.4
1.5.5
27/03/2025
RTMKit <= 1.6.7 – Authenticated (Contributor+) Insecure Direct Object Reference
The RTMKit plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.7 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level…
*-1.6.7
1.6.8
14/02/2025
RomethemeKit For Elementor <= 1.5.2 – Missing Authorization
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.5.2. This makes it possible for authenticated attackers, with Subscriber-level…
*-1.5.2
1.5.3
24/01/2025
RomethemeKit For Elementor <= 1.5.2 – Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and…
*-1.5.2
1.5.3
23/01/2025
RomethemeKit For Elementor <= 1.5.3 – Missing Authorization in save_options and reset_widgets
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible…
*-1.5.3
1.5.4
14/01/2025
RomethemeKit For Elementor <= 1.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…
*-1.5.0
1.5.1
30/09/2024
RomethemeKit For Elementor <= 1.4.1 – Missing Authorization
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addNewPost() function in versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers…
*-1.4.1
1.4.2
29/04/2024
RomethemeKit For Elementor <= 1.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…
*-1.4.1
1.4.2
22/04/2024
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.