RTMKit

Уязвимости

• CVE-2025-62065нужен вход≤ 1.6.5

  WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability

  Критич. 9.9

• CVE-2025-30911нужен вход≤ 1.5.4

  WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability

  Критич. 9.9

• CVE-2026-84752участник+≤ 2.1.5

  WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

  Высокий 8.8

• CVE-2026-3425автор+≤ 2.0.2

  RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'

  Высокий 8.8

• CVE-2026-84763без авторизации · нужен клик≤ 2.1.5

  WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2024-33919без авторизации≤ 1.4.1

  WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2025-64283нужен вход≤ 1.6.7

  WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability

  Средний 6.5

• CVE-2025-49235нужен вход≤ 1.6.0

  WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-47626нужен вход≤ 1.5.0

  WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2024-32956нужен вход≤ 1.4.1

  WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-5149участник+≤ 2.0.7

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter

  Средний 6.5

• CVE-2026-8351участник+≤ 2.0.7

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter

  Средний 6.4

• CVE-2025-8609участник+≤ 1.6.5

  RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute

  Средний 6.4

• CVE-2025-12473без авторизации · нужен клик≤ 1.6.8

  RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter

  Средний 6.1

• CVE-2026-62133подписчик+≤ 2.1.5

  WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 5.4

• CVE-2024-10326подписчик+≤ 1.5.3

  RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets

  Средний 4.3

• CVE-2025-24743нужен вход≤ 1.5.2

  WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability

  Средний 4.3

• CVE-2026-5137участник+≤ 2.0.7

  RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter

  Средний 4.3

• CVE-2026-3426автор+≤ 2.0.2

  RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification

  Средний 4.3

• CVE-2024-10324участник+≤ 1.5.2

  RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

  Средний 4.3