Log in Start free

Rometheme

Products

ProductCVEsExploitedLatest
RTMKit19–Sep 11, 2026
RomethemeForm For Elementor2–Aug 18, 2026
RomethemeKit For Elementor1–May 3, 2024
RTMForm Builder1–May 23, 2024

Exploited and recent CVEs

  • CVE-2026-62133 Medium 5.4 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-84763 High 7.1 WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-84752 High 8.8 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability 0.5%
  • CVE-2026-74003 Medium 4.3 WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-5137 Medium 4.3 RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter 0.4%
  • CVE-2026-8351 Medium 6.4 RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter 0.4%
  • CVE-2026-5149 Medium 6.5 RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter 0.3%
  • CVE-2026-3426 Medium 4.3 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification 0.3%
  • CVE-2026-3425 High 8.8 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' 0.6%
  • CVE-2025-12473 Medium 6.1 RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter 0.3%
  • CVE-2025-8609 Medium 6.4 RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute 0.2%
  • CVE-2025-62065 Critical 9.9 WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability 0.3%
  • CVE-2025-64283 Medium 6.5 WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2025-49235 Medium 6.5 WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-30911 Critical 9.9 WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability 1.9%
  • CVE-2024-10326 Medium 4.3 RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets 0.4%
  • CVE-2025-24743 Medium 4.3 WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability 0.3%
  • CVE-2024-10324 Medium 4.3 RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates 0.3%
  • CVE-2024-47626 Medium 6.5 WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-32727 Medium 5.3 WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability 0.3%
  • CVE-2023-6325 Medium 5.3 RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate 0.4%
  • CVE-2024-33919 Medium 6.5 WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability 0.4%
  • CVE-2024-32956 Medium 6.5 WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 0.3%