RTMKit vulnerabilities

3 known vulnerabilities in RTMKit from Rometheme. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  RTMKit: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2026-3425May 13, 2026Rometheme

  The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers, with Author-le

• 9.9 Critical severity

  RTMKit: Unrestricted Upload of File with Dangerous Type

  CVE-2025-62065Nov 6, 2025Rometheme

  Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5.

• 9.9 Critical severity

  RTMKit: Improper Control of Generation of Code

  CVE-2025-30911Apr 1, 2025RomethemeEPSS 1.94%

  Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Command Injection.This issue affects RTMKit: from n/a through <= 1.5.4.