Rank Math Seo

WordPress plugin · rank-math-seo · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Rank Math Seo on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import CVE.org	>=0, <1.0.280	v1.0.280	CVE-2026-104752	Oct 10, 2026
MEDIUM CVSS 5.3	Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion CVE.org	>=0, <1.0.280	v1.0.280	CVE-2026-104751	Oct 14, 2026
MEDIUM CVSS 4.1	Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter CVE.org	>=0, <1.0.280	v1.0.280	CVE-2026-104753	Oct 10, 2026
MEDIUM CVSS 4.9	Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas CVE.org	>=1.0.48, <1.0.277	v1.0.277	CVE-2026-77788	Sep 2, 2026
MEDIUM CVSS 5.3	Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt CVE.org	>=0, <1.0.277.1	v1.0.277.1	CVE-2026-77782	Sep 2, 2026
MEDIUM CVSS 4.9	Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability CVE.org	>=1.0.271, <1.0.277	v1.0.277	CVE-2026-77786	Aug 29, 2026
LOW CVSS 3.5	Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL CVE.org	>=0, <1.0.280	v1.0.280	CVE-2026-104754	Oct 10, 2026
LOW CVSS 3.7	Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure CVE.org	>=1.0.48, <1.0.277	v1.0.277	CVE-2026-77783	Sep 2, 2026
LOW CVSS 2.7	Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as CVE.org	>=0, <1.0.277	v1.0.277	CVE-2026-77784	Sep 2, 2026
LOW CVSS 2.7	Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API CVE.org	>=1.0.272, <1.0.277	v1.0.277	CVE-2026-77785	Sep 2, 2026
LOW CVSS 2.7	Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk CVE.org	>=1.0.255, <1.0.277	v1.0.277	CVE-2026-77787	Sep 2, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.