Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Rometheme
Rtmkit

Rometheme RTMKit Vulnerabilities: CVEs, CISA KEV & Security Advisories

13 CVEs

Rometheme RTMKit Vulnerabilities

CVE security advisories and vulnerability history for RTMKit by Rometheme.

13

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

With known exploit

6.5

Avg CVSS

2024–2026

Last updated May 13, 2026

Overview

Rometheme RTMKit has 13 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Rometheme RTMKit, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Rometheme RTMKit's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High1

Medium10

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Rometheme RTMKit's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Rometheme RTMKit CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Rometheme RTMKit version named in a CVE, then pick one to see only the CVEs that affect it.

Fixed in

> 1.5.22 CVEs
> 1.6.52 CVEs
> 2.0.22 CVEs
> 1.4.11 CVE
> 1.5.01 CVE
> 1.5.31 CVE
> 1.5.41 CVE
> 1.6.01 CVE
> 1.6.71 CVE
> 1.6.81 CVE
1.4.21 CVE
1.5.11 CVE
1.5.31 CVE
1.5.51 CVE
1.6.11 CVE
1.6.61 CVE
1.6.81 CVE

Find a version

13 CVEs

Sort

RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
CVE-2026-3426
Patch
CWE-862
Medium · CVSS 4.3
EPSS 0.0% (11th pct)2026-05-13
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
CVE-2026-3425
Patch
CWE-98
High · CVSS 8.8
EPSS 0.1% (24th pct)2026-05-13
RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
CVE-2025-12473
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.1% (30th pct)2026-03-11
RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
CVE-2025-8609
Patch
CWE-79
Medium · CVSS 6.4
EPSS 0.0% (10th pct)2025-11-18
WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
CVE-2025-62065
Patch
CWE-434
Critical · CVSS 9.9
EPSS 0.1% (21th pct)2025-11-06
WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability
CVE-2025-64283
Patch
CWE-639
Medium · CVSS 6.5
EPSS 0.0% (13th pct)2025-10-29
WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
CVE-2025-49235
Patch
CWE-79
Medium · CVSS 6.5
EPSS 0.1% (34th pct)2025-06-06
WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability
CVE-2025-30911
Patch
CWE-94
Critical · CVSS 9.9
EPSS 0.3% (57th pct)2025-04-01
RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets
CVE-2024-10326
Patch
CWE-862
Medium · CVSS 4.3
EPSS 0.1% (17th pct)2025-03-08
WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability
CVE-2025-24743
Patch
CWE-862
Medium · CVSS 4.3
EPSS 0.2% (40th pct)2025-01-27
RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
CVE-2024-10324
Patch
CWE-1230
Medium · CVSS 4.3
EPSS 0.2% (43th pct)2025-01-24
WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
CVE-2024-47626
Patch
CWE-79
Medium · CVSS 6.5
EPSS 0.2% (41th pct)2024-10-05
WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
CVE-2024-32956
Patch
CWE-79
Medium · CVSS 6.5
EPSS 0.1% (28th pct)2024-04-24

Common weakness types

The CWE weakness categories most often found in Rometheme RTMKit CVEs. Follow any weakness for its full explanation.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-862Missing Authorization3 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVE
CWE-639Authorization Bypass Through User-Controlled Key1 CVE
CWE-1230Exposure of Sensitive Information Through Metadata1 CVE
CWE-94Improper Control of Generation of Code ('Code Injection')1 CVE
CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')1 CVE

Disclosure activity by year

How many Rometheme RTMKit CVEs were published each year.

2024

2

2025

8

2026

3

Other Rometheme products

Browse vulnerabilities for other products by Rometheme.

romethemekit for elementor3 CVEs romethemeform_for_elementor2 CVEs RomethemeForm For Elementor1 CVEs romethemekit_for_elementor1 CVEs RTMForm Builder1 CVEs

All Rometheme vulnerabilities

Frequently asked questions

Common questions about Rometheme RTMKit vulnerabilities.

How many CVEs does Rometheme RTMKit have?

Rometheme RTMKit has 13 published CVE records since 2024.

How many Rometheme RTMKit CVEs are in CISA KEV?

None of Rometheme RTMKit's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for Rometheme RTMKit vulnerabilities?

No Rometheme RTMKit CVEs currently have a tracked public exploit in this dataset.

Which versions of Rometheme RTMKit are affected?

17 distinct Rometheme RTMKit versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Rometheme RTMKit CVEs?

Rometheme RTMKit's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-639 (Authorization Bypass Through User-Controlled Key).

How many critical Rometheme RTMKit vulnerabilities are there?

Rometheme RTMKit has 2 critical and 1 high-severity CVEs.

What is the average severity of Rometheme RTMKit CVEs?

The average CVSS base score across Rometheme RTMKit's scored CVEs is 6.5.

References

All Rometheme vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Rometheme RTMKit vulnerabilities

Monitor new Rometheme RTMKit vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References