Cross-Site Scripting Vulnerability in Rometheme RTMKit Addons for Elementor
CVE-2025-49235

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Rtmkit Addons For Elementor
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49235?

A Cross-Site Scripting (XSS) vulnerability has been identified in the Rometheme RTMKit Addons for Elementor, enabling malicious users to inject harmful scripts. This flaw allows for Stored XSS, which can compromise user sessions, manipulate webpage content, or redirect users to malicious sites. Affected versions include RTMKit Addons for Elementor up to and including 1.6.0. Website owners using this plugin should prioritize updates to mitigate the risk of exploitation.

Affected Version(s)

RTMKit Addons for Elementor <= 1.6.0

References

https://patchstack.com/database/wordpress/plugin/romethem...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Prissy (Patchstack Alliance)
JSON
.