PT-2026-55506 · Rometheme · Rtmkit

Theviper17Y · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-8351

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background text heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8351

Affected Products

Rtmkit

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-8351 · Security Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.7/Inc/Elements/AdvancedHeading.php#L960 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e0da463-2ba0-43ca-927c-55c12643ef32?source=cve · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Elements/AdvancedHeading.php#L960 · Note
• https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Elements/AdvancedHeading.php · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.7/Inc/Elements/AdvancedHeading.php#L133 · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.4/Inc/Elements/AdvancedHeading.php#L133 · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Elements/AdvancedHeading.php#L133 · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.4/Inc/Elements/AdvancedHeading.php#L960 · Note