Plugin icon

RTMKit

rometheme-for-elementor

Vulnerabilities:

12

Last Updated:

March 27, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-03-10
Title
RTMKit < 2.0.0 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
Fixed in
Fixed in 2.0.0
CVSS
6.1 (medium)
Published
2025-11-17
Title
RTMKit Addons < 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
Fixed in
Fixed in 1.6.6
CVSS
6.4 (medium)
Published
2025-10-18
Title
RTMKit < 1.6.6 - Authenticated (Contributor+) Arbitrary File Upload
Fixed in
Fixed in 1.6.6
CVSS
8.8 (high)
Published
2025-06-05
Title
RTMKit Addons for Elementor < 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.1
CVSS
6.4 (medium)
Published
2025-03-27
Title
RomethemeKit For Elementor < 1.5.5 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Fixed in
Fixed in 1.5.5
CVSS
8.8 (high)
Published
2025-02-14
Title
RTMKit < 1.6.8 - Authenticated (Contributor+) Insecure Direct Object Reference
Fixed in
Fixed in 1.6.8
CVSS
4.3 (medium)
Published
2025-01-24
Title
RomethemeKit For Elementor < 1.5.3 - Missing Authorization
Fixed in
Fixed in 1.5.3
CVSS
4.3 (medium)
Published
2025-01-23
Title
RomethemeKit For Elementor < 1.5.3 - Contributor+ Sensitive Information Exposure via Elementor Templates
Fixed in
Fixed in 1.5.3
CVSS
4.3 (medium)
Published
2025-01-14
Title
RomethemeKit For Elementor < 1.5.4 - Missing Authorization in save_options and reset_widgets
Fixed in
Fixed in 1.5.4
CVSS
4.3 (medium)
Published
2024-09-30
Title
RomethemeKit For Elementor < 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.1
CVSS
6.4 (medium)
Published
2024-04-29
Title
RomethemeKit For Elementor < 1.4.2 - Missing Authorization
Fixed in
Fixed in 1.4.2
CVSS
5.3 (medium)
Published
2024-04-22
Title
RomethemeKit For Elementor < 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.4.2
CVSS
6.4 (medium)