CVE-2026-8351

Name of the Vulnerable Software and Affected Versions RTMKit versions prior to 2.0.8

Description The RTMKit plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the render() function fails to apply esc attr() to the background text heading setting within the Advanced Heading widget, allowing the value to be concatenated directly into an HTML attribute. Authenticated attackers with contributor-level access or higher can exploit this by injecting arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update RTMKit to a version newer than 2.0.7. As a temporary mitigation, restrict access to the Advanced Heading widget's 'Background Text' parameter for users with contributor-level access.