What’s Vulnerable › Products
Rank Math SEO vulnerabilities
27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your Rank Math SEO version is affected
Latest Rank Math SEO vulnerabilities
- CVE-2026-104751 — Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion (CVSS 5.3)
- CVE-2026-104754 — Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL (CVSS 3.5)
- CVE-2026-104753 — Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter (CVSS 4.1)
- CVE-2026-104752 — Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import (CVSS 7.2)
- CVE-2026-77788 — Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas (CVSS 4.9)
- CVE-2026-77787 — Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk (CVSS 2.7)
- CVE-2026-77785 — Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API (CVSS 2.7)
- CVE-2026-77784 — Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as (CVSS 2.7)
- CVE-2026-77783 — Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure (CVSS 3.7)
- CVE-2026-77782 — Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt (CVSS 5.3)
- CVE-2026-77786 — Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability (CVSS 4.9)
- CVE-2025-12714 — Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification (CVSS 5.3)
- CVE-2024-13229 — Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion (CVSS 4.3)
- CVE-2024-13227 — Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API (CVSS 5.4)
- CVE-2024-9314 — Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2)
- CVE-2024-9161 — Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete (CVSS 6.5)
- CVE-2024-4627 — Rank Math SEO < 1.0.219 - Authenticated Stored XSS (CVSS 5.4)
- CVE-2023-23888 — WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability (CVSS 8.8)
- CVE-2024-4617 — Rank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2024-4335 — Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-3665 — Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper' (CVSS 5.4)
- CVE-2024-2536 — Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes (CVSS 5.4)
- CVE-2023-32600 — WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2022-36376 — WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability (CVSS 9.8)
- CVE-2020-11515 — (CVSS 6.1)