CVE-2026-104754
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
Risk Assessment
An attacker with administrator privileges can execute malicious script in the sessions of other administrators, potentially leading to account takeover, privilege escalation, or further site compromise.
Recommendation
Update the Rank Math SEO plugin to version 1.0.280 or later, which includes the security fix.
Other vulnerabilities in Rank Math SEO
See all- CVE-2026-104753Medium
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
- CVE-2026-104752High
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
- CVE-2026-77787Low
The Rank Math SEO WordPress plugin before version 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
- CVE-2026-77785Low
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata. This allows users with the Author role and above to read the title, body, and metadata of other users' non-public posts.
- CVE-2026-77784Low
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata. This allows users with the Author role and above to alter that metadata on content, taxonomy terms, and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.
- CVE-2026-77783Low
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts.
- CVE-2026-77786Medium
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- CVE-2026-81757High
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
- CVE-2026-66702High
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
- CVE-2026-34892Medium
There is a broken access control issue in Rank Math SEO versions up to 1.0.271 that may allow unauthorized users to access subscription features.
Original NVD description (English source)
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS