← back to popular plugins
wordfence / plugin · seo-by-rank-math
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
seo-by-rank-math
total installs
4,000,000
total vulns
16
critical
0
high
3
medium
12
low
1
latest vuln
—
patched
16
unpatched
0
avg time to patch
—
vulnerabilities
(16)
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-104754 ↗
cvss score
4.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 8, 2026
The Rank Math SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0.279. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Arbitrary File Upload
high
✓ patched
cve id
CVE-2026-104752 ↗
cvss score
7.2
cwe
CWE-434: Unrestricted Upload of File with Dangerous Type
published
Oct 8, 2026
The Rank Math SEO plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.279. This is due to missing file type validation. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) SQL Injection
medium
✓ patched
cve id
CVE-2026-104753 ↗
cvss score
4.9
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 8, 2026
The Rank Math SEO plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.279. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) SEO Object Updates
medium
✓ patched
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 1.0.277 (exclusive). This makes it possible for authenticated attackers, with Author-level access and above, to update SEO objects.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure
medium
✓ patched
cve id
CVE-2026-77785 ↗
cvss score
4.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Sep 2, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.0.277. This makes it possible for authenticated attackers, with author-level access and above, to extract sensitive user or configuration data.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Unauthenticated Information Exposure
medium
✓ patched
cve id
CVE-2026-77783 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Sep 2, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.0.277. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
medium
✓ patched
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access in all versions up to 1.0.277. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with author-level access and above, to perform an unauthorized action.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
medium
✓ patched
cve id
CVE-2026-77788 ↗
cvss score
4.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Aug 31, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 1.0.277 (exclusive). This makes it possible for authenticated attackers, with Author-level access and above, to overwrite post and user metadata.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure
medium
✓ patched
cve id
CVE-2026-77782 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 31, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.0.277.1. This is due to missing post_password_required() checks before using post content to generate SEO metadata. This makes it possible for unauthenticated attackers to read the content of password-protected posts via publicly generated SEO metadata such as schema blocks, meta descriptions, and Open Graph data.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
low
✓ patched
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access in all versions up to 1.0.277. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with editor-level access and above, to perform an unauthorized action.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution
high
✓ patched
cve id
CVE-2026-81757 ↗
cvss score
8.8
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Aug 27, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.276. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with author-level access and above, to execute arbitrary code on the server.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-66702 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jul 31, 2026
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.274.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization
medium
✓ patched
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.271. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
medium
✓ patched
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.
Rank Math SEO <= 1.0.252.1 - Authenticated (Subscriber+) Information Exposure
medium
✓ patched
cve id
CVE-2025-64351 ↗
cvss score
4.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Sep 11, 2025
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.252.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.
Rank Math SEO <= 1.0.252.1 - Missing Authorization
medium
✓ patched
The Rank Math SEO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the track() function in versions up to, and including, 1.0.252.1. This makes it possible for authenticated attackers, with author-level access and above, to perform an unauthorized action.