The RTMKit plugin for WordPress is vulnerable to stored cross‑site scripting via the Advanced Heading widget’s “Background Text” parameter in versions up to and including 2.0.7. The flaw stems from insufficient output escaping on the background_text_heading setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). Authenticated attackers, with contributor‑level access or higher, can inject arbitrary JavaScript that executes whenever a user views a page containing the injected widget.

WordPress sites that have the RTMKit plugin installed in any version up to and including 2.0.7 and that use the flawed widget. The flaw exists in all releases of RTMKit from the vendor rometheme through version 2.0.7.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess contributor or higher privileges to modify the widget and inject malicious code; after injection, the script will execute for every visitor who loads the affected page.