CVE-2026-66702
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
Risk Assessment
An attacker can steal user data such as sessions or cookies, potentially leading to account takeover or malware distribution.
Recommendation
Update the Rank Math SEO plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Rank Math SEO
See all- CVE-2026-77786Low risk· EPSS 3%
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- CVE-2026-81757High
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
- CVE-2026-34892Medium
There is a broken access control issue in Rank Math SEO versions up to 1.0.271 that may allow unauthorized users to access subscription features.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.