CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,249 CVEs published, 240 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,249
Show in the list
Critical, last 7 days
240
Show in the list
Healthcare-tagged, last 7 days
6
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product rometheme:rtmkit. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

12 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2025-64283Medium 6.5WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability
Assigned by Patchstack
Oct 29, 2025
CVE-2025-62065Critical 9.9WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability
Assigned by Patchstack
Nov 6, 2025
CVE-2025-8609Medium 6.4RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute
Assigned by Wordfence
Nov 18, 2025
CVE-2025-12473Medium 6.1RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
Assigned by Wordfence
Mar 10, 2026
CVE-2026-3425High 8.8RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
Assigned by Wordfence
May 13, 2026
CVE-2026-3426Medium 4.3RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
Assigned by Wordfence
May 13, 2026
CVE-2026-5149Medium 6.5RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
Assigned by Wordfence
Jun 16, 2026
CVE-2026-8351Medium 6.4RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
Assigned by Wordfence
Jul 3, 2026
CVE-2026-5137Medium 4.3RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
Assigned by Wordfence
Jul 3, 2026
CVE-2026-84752High 8.8WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
Assigned by Patchstack
Sep 3, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .