The RTMKit WordPress plugin contains a Reflected Cross‑Site Scripting flaw that is triggered by sending the "themebuilder" parameter in any request. The vulnerability arises from insufficient input sanitization and output escaping, which allows an unauthenticated attacker to embed arbitrary JavaScript. If a site administrator inadvertently visits a crafted URL or clicks a malicious link, the malicious script will run in the administrator’s browser and could be used to modify page content or compromise the session.

All releases of the RTMKit plugin provided by rometheme that are version 1.6.8 or older are affected, as indicated by the vendor’s code repository references.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is reported as less than 1 %, suggesting a low likelihood of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is unauthenticated, remote, web‑based exploitation that requires delivering a crafted request containing a malicious value for the "themebuilder" parameter to an administrator’s browser.