WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

The WordPress RomethemeKit plugin for Elementor doesn't properly clean user inputs, allowing attackers to inject malicious scripts that get stored and executed when others view the page. This can compromise user accounts and steal sensitive data.

Stored XSS vulnerability in RTMKit <= 1.5.0 due to improper input sanitization during web page generation. An authenticated or unauthenticated attacker can inject malicious JavaScript that persists in the database and executes in victims' browsers, potentially leading to session hijacking, credential theft, or malware distribution.