CVE-2026-8351 is a stored cross-site scripting vulnerability in the RTMKit plugin for WordPress, affecting versions up to 2.0.7. The issue arises from insufficient output escaping of the 'background_text_heading' setting in the render() function, which directly concatenates user input into an HTML attribute without using esc_attr(). This flaw enables authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages.

An attacker with contributor-level or higher access can inject persistent malicious scripts via the 'Background Text' parameter of the Advanced Heading widget. These scripts execute in the browsers of users who view the infected pages, potentially leading to data theft, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions.

No official patch or fix has been confirmed as of the published date. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Advanced Heading widget if feasible to reduce exposure.