Stored Cross-Site Scripting in RTMKit Plugin for WordPress

CVE-2026-8351

What is CVE-2026-8351?

The RTMKit plugin for WordPress allows authenticated attackers with contributor-level access and above to exploit stored cross-site scripting vulnerabilities. The vulnerability arises from insufficient output escaping in the Advanced Heading widget's 'Background Text' parameter, specifically in how the 'background_text_heading' setting is rendered. Without proper sanitization, attackers can inject arbitrary web scripts into pages, which will execute whenever a user visits the affected page. This poses a significant risk to the security and integrity of the site's content.

References