EUVD-2026-69842

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2026-77783

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , is vulnerable to an information disclosure flaw because it fails to verify if a post is publicly viewable before rendering its schema on the front end. This allows unauthenticated visitors to access and disclose the schema and ass...

CVE-2026-77787 Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

EUVD-2026-69841

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-77787 Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite vulnerability

Author+ Arbitrary Post and User Metadata Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77784

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains an authorization bypass vulnerability. The plugin fails to verify if a user is permitted to edit an object before updating its SEO indexing metadata . This allows users with the Author role or higher to modify metadata on cont...

CVE-2026-77785

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , is vulnerable to a content disclosure flaw because it fails to verify if a requesting user has permission to access specific posts. This allows users with the Author role and above to view the title, body, and metadata of non-publ...

EUVD-2026-69838

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-77788

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , contains an authorization bypass vulnerability. The plugin fails to verify that a metadata row being updated belongs to the specific object the user is authorized to access. This flaw allows users with the Author role or higher to...

CVE-2026-77792 RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77787

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains a vulnerability where it fails to perform a capability check during bulk metadata updates for taxonomy terms. The application also reuses the supplied object identifier across different object types. This allows users with the...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2026-19723 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-74927

The MultiVendorX WordPress plugin (versions 5.0.13-5.0.14 ) is vulnerable to an unauthenticated information disclosure due to insufficient authorization controls on a REST API listing route. An attacker can exploit this flaw to retrieve sensitive data, including vendor contact and payout details ...