CVE-2026-8351: RTMKit WordPress Plugin Stored XSS Vulnerability in Advanced Heading Widget

Technical summary

CVE-2026-8351 is a Stored XSS vulnerability in RTMKit versions up to 2.0.7, specifically in the Advanced Heading widget's render() function. The vulnerability stems from the 'background_text_heading' setting being concatenated directly into an HTML attribute without applying WordPress's esc_attr() escaping function. An authenticated attacker with contributor access or above can inject arbitrary JavaScript that executes in the context of the site for all visitors, enabling session hijacking, credential theft, malware distribution, or defacement. The CVSS 3.1 score of 6.4 (MEDIUM) reflects the requirement for authenticated access and the cross-site scope of impact.

Business impact

If your WordPress installation uses RTMKit and permits contributor-level users, this vulnerability creates a path for insider threats or compromised contributor accounts to inject malicious code that affects all site visitors. The stored nature means an attack persists until discovered and remediated. Potential business consequences include brand damage from defacement, visitor data theft, SEO poisoning, or malware distribution from your domain. The impact scales with site traffic and trust—high-traffic sites risk broader visitor compromise.

Affected systems

The RTMKit plugin for WordPress is affected in versions up to and including 2.0.7. No vendor product versions are listed in the CVE record, indicating this is a third-party plugin vulnerability. Affected installations are those running vulnerable RTMKit versions with users holding contributor or editor roles.

Exploitability

Exploitation requires valid WordPress authentication and contributor-level (or higher) access, making this an authenticated attack. The barrier is moderate—insider threats, compromised accounts, or misconfigured role assignments can enable exploitation. Once injected, the malicious script executes automatically whenever the page is viewed, requiring no victim action beyond visiting the page. There is no evidence this vulnerability is actively exploited in the wild or included in CISA's KEV catalog.

Remediation

Update RTMKit to a patched version above 2.0.7 (verify the specific version against the vendor's official advisory and plugin repository). As an interim measure, restrict contributor and editor role assignments to trusted users only, and audit existing pages created with the Advanced Heading widget for suspicious content. After updating, scan your site for any injected malicious scripts in post/page content and consider using security plugins to monitor for unauthorized content changes.

Patch guidance

Check the RTMKit plugin repository or vendor advisory for the first patched version released after 2.0.7. Deploy the update through WordPress's plugin management interface. Before applying, test the update in a staging environment to ensure compatibility with your theme and other active plugins. After deployment, verify that the Advanced Heading widget continues to function correctly and that no previously injected content remains active. If you maintain a custom installation, the fix should involve wrapping the 'background_text_heading' value with esc_attr() before output.

Detection guidance

Monitor for suspicious JavaScript patterns in pages using the Advanced Heading widget, especially <script>, onerror=, onload=, or other event handlers embedded in attribute values. Query your WordPress database for the presence of unusual content in posts or pages that use RTMKit components. Enable security logging on contributor and editor account activities to detect unauthorized edits. Use WordPress security plugins with file integrity monitoring and content scanning to flag injected scripts. Check your site's HTML source for unexpected inline JavaScript in heading sections.

Why prioritize this

Prioritize this vulnerability if your WordPress site uses RTMKit and allows contributor-level users, or if any contributor accounts may be compromised. Although the CVSS is MEDIUM and exploitation requires authentication, the stored nature and broad visitor impact justify prompt attention. If RTMKit is not used, this poses no risk.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects: (1) the requirement for authenticated access (PR:L), reducing initial attack surface; (2) network-adjacent attack vector (AV:N) and low complexity (AC:L), making authenticated exploitation straightforward; (3) cross-site scope (S:C), indicating the injected script affects users outside the attacker's security context; and (4) confidentiality and integrity impact (C:L/I:L) without availability loss. The score does not account for the persistence risk inherent in stored XSS, which increases operational impact beyond the base score.

Frequently asked questions