Reflected Cross-Site Scripting Vulnerability in RTMKit Plugin for WordPress

CVE-2025-12473

What is CVE-2025-12473?

The RTMKit plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping within the 'themebuilder' parameter. This vulnerability allows an unauthenticated attacker to inject malicious scripts, which could be executed in the browser of a user tricked into clicking a manipulated link. All versions up to and including 1.6.8 are impacted, heightening the risk for sites utilizing this plugin if not updated.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References