CVE-2024-13227

The CVE-2024-13227 entry affects the WordPress plugin Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (vulnerable up to 1.0.235). The vulnerability is a Stored Cross-Site Scripting flaw caused by insufficient input sanitization and output escaping on user-supplied attributes via the Rank Ma...

CVE-2024-4335

CVE-2024-4335: The Rank Math SEO with AI Best SEO Tools WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) via the textAlign parameter in versions up to and including 1.0.217. This requires authenticated access at contributor level or higher and can let an attacker inject scri...

CVE-2024-9161

The CVE-2024-9161 entry affects the WordPress plugin Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (versions up to 1.0.228). The root cause is a missing capability check in the function update_metadata , which allows unauthenticated users to insert, update, or delete metadata (including u...

CVE-2024-13229

CVE-2024-13229 concerns Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (WordPress) vulnerability: missing capability check in update_metadata() allows authenticated attackers with Contributor+ to delete schema metadata on posts. Affected versions include up to 1.0.235. Exploitation is desc...

CVE-2024-4627

CVE-2024-4627 affects Rank Math SEO for WordPress prior to 1.0.219. It is an authenticated Stored XSS due to insufficient sanitisation/escaping of settings, exploitable by users with access to General Settings (admin by default, but grantable via Role Manager in

CVE-2024-9314

Rank Math SEO – AI Tools to Dominate SEO Rankings (WordPress) is affected by CVE-2024-9314: authenticated administrators can deserialise untrusted input via the set_redirections path, enabling PHP Object Injection in versions up to and including 1.0.228. The vulnerability description notes that n...

CVE-2022-36376

CVE-2022-36376 : A Server-Side Request Forgery (SSRF) vulnerability affects the WordPress Rank Math SEO plugin, versioned at or below 1.0.95. The issue is documented across multiple sources (NVD, OSV, patchstack, GitHub advisories). The core problem is an SSRF condition in Rank Math prior to a ne...

CVE-2020-11514

The CVE-2020-11514 issue affects the Rank Math SEO WordPress plugin (versions up to 1.0.40.2). The vulnerability allows unauthenticated remote attackers to update arbitrary WordPress metadata via the unsecured rankmath/v1/updateMeta REST API endpoint, enabling privilege escalation to administrato...

CVE-2020-11515

Rank Math SEO plugin for WordPress (versions ≤ 1.0.40.2) contains an unprotected REST endpoint rankmath/v1/updateRedirection that lets unauthenticated attackers create new redirect URIs to external sites. This is not an Open Redirect issue; attackers can create arbitrary URI names (e.g., /example...

CVE-2024-2536

CVE-2024-2536 affects the Rank Math SEO with AI Tools plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via HowTo block attributes due to insufficient input sanitization and output escaping. It impacts all versions up through 1.0.214 and requires contributor-level or higher a...

CVE-2024-3665

CVE-2024-3665 details (Rank Math SEO with AI SEO Tools, WordPress): Stored Cross-Site Scripting in the HowTo and FAQ widgets of the Rank Math plugin, affecting all versions up to 1.0.216. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes...

CVE-2023-32600

CVE-2023-32600 is a stored XSS vulnerability in WordPress Rank Math SEO plugin versions <= 1.0.119. The vulnerability affects the plugin’s handling of input in a way that could allow an attacker with Contributor-level privileges and user interaction to induce script execution (per CVSS vector:...

CVE-2023-23888

The CVE-2023-23888 entry concerns the WordPress Rank Math SEO plugin (

CVE-2019-14786

CVE-2019-14786 affects WordPress Rank Math SEO plugin (version 1.0.27). The vulnerability allows any authenticated user (non-admin) to reset plugin settings via wp-admin/admin-post.php?reset-cmb parameter. The issue is documented across multiple sources (NVD, Red Hat, OpenVAS, WPVulnDB) and relat...