CVE-2026-77782

The Rank Math SEO WordPress plugin, versions before 1.0.277.1 , fails to check whether a post is password-protected before using its content to build publicly generated SEO metadata (via post metadata and llms.txt ). This allows unauthenticated users to read the content of password-protected post...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

CVE-2026-77782 Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

PT-2026-84620

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77786

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77786

Rank Math SEO for WordPress, before version 1.0.277 , fails to verify that the user requesting an automated SEO fix holds the WordPress capability required for the settings being changed. The specific fix-site-seo ability allows users with the Editor role (or higher) to modify site-wide core Word...

CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-81757

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

CVE-2026-81757

CVE-2026-81757 is a Remote Code Execution (RCE) vulnerability in the Rank Math SEO WordPress plugin, affecting versions ≤ 1.0.276 . The flaw is exploitable by users with Author -level permissions, meaning a low-privilege authenticated user can escalate to full code execution on the server. The CV...

EUVD-2026-67730

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

CVE-2026-81757 WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

WordPress Slim SEO plugin < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure vulnerability

Contributor+ Arbitrary Post Meta Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Slim SEO versions 4.9.11...

WordPress ImproveSEO plugin <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by João Ramos Maciel in WordPress Plugin Improve SEO versions = 2.0.11...

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China,...

CVE-2026-66614

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

CVE-2026-66614

The WordPress SEO Plugin by Squirrly SEO (versions ≤ 14.2.2) contains an unauthenticated reflected/stored XSS vulnerability exploitable via crafted input, with CVSS 3.1 score 7.1 (HIGH). No exploit code or in-the-wild exploitation details are provided in the documents; patch version is not specif...

CVE-2026-66614 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

EUVD-2026-63298

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

preflight v0.20.1

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...