Description
The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-03
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The RTMKit WordPress plugin contains a stored cross‑site scripting flaw in the Advanced Heading widget’s ‘Background Text’ parameter. When a user with contributor‑level access or higher supplies malicious input, the value is concatenated directly into an HTML attribute without escaping, allowing the injection of arbitrary JavaScript that will run whenever a page containing the widget is viewed.

Affected Systems

WordPress sites that have the RTMKit plugin installed in any version up to and including 2.0.7 and that use the Advanced Heading widget are affected. The flaw is present in all releases of RTMKit from the vendor rometheme through version 2.0.7.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess contributor or higher privileges to modify the widget and insert malicious code, after which the injected script will execute for each site visitor that loads the affected page.

Generated by OpenCVE AI on July 4, 2026 at 09:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest RTMKit plugin version (2.0.8 or later) to remove the vulnerable code.
  • If an update cannot be applied, disable or remove the Advanced Heading widget from pages that are not critical, or limit contributor access to prevent exploitation.
  • As a temporary measure, deploy a web‑application firewall rule that filters or sanitizes the ‘background_text_heading’ parameter before it is stored or rendered.

Generated by OpenCVE AI on July 4, 2026 at 09:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Rometheme
Rometheme rtmkit
Wordpress
Wordpress wordpress
Vendors & Products Rometheme
Rometheme rtmkit
Wordpress
Wordpress wordpress

Fri, 03 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Description The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'background_text_heading' setting in the render() function, which concatenates the value directly into an HTML attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Rometheme Rtmkit
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-03T06:50:10.581Z

Reserved: 2026-05-11T16:41:26.786Z

Link: CVE-2026-8351

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-04T09:30:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')