Description
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-03
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The RTMKit WordPress plugin contains a stored cross‑site scripting flawBackground Text’ parameter. When a user with contributor‑level access or higher supplies malicious input, the value is concatenated directly into an HTML attribute without escaping, allowing the run whenever a page containing the widget is viewed.

Affected Systems

WordPress sites that have the RTMKit plugin installed in any version up to and including 2.0.7 and that use the flaw is present in all releases of RTMKit from the vendor rometheme through version 2.0.7.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity flaw. The EPSS score of < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess contributor or higher privileges to modify the widget and insert malicious code, after which the injected script will execute for each site visitor that loads the affected page.

Generated by OpenCVE AI on July 21, 2026 at 10:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest RTMKit plugin version (2.0.8 or later) to remove the vulnerable code.
  • If an update cannot be applied widget from pages that are not critical, or limit contributor access to prevent exploitation.
  • Configure a web‑application firewall rule to sanitize or block malicious input in the 'background_text_heading' parameter.

Generated by OpenCVE AI on July 21, 2026 at 10:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Rometheme
Rometheme rtmkit
Wordpress
Wordpress wordpress
Vendors & Products Rometheme
Rometheme rtmkit
Wordpress
Wordpress wordpress

Fri, 03 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Description The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Rometheme Rtmkit
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:25:21.787Z

Reserved: 2026-05-11T16:41:26.786Z

Link: CVE-2026-8351

cve-icon Vulnrichment

Updated: 2026-07-06T16:24:42.570Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:15:02Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')