Description

Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:23.117Z",
  "pubdate": "2026-08-06T15:17:23.117Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Rank Math SEO plugin affecting versions <= 1.0.274.1. This security flaw enables remote, unauthenticated threat actors to inject arbitrary malicious client-side scripts, typically JavaScript, into victim browsers via vulnerable application parameters.\nThe primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed within the context of an authenticated user, and defacement of the affected WordPress site. Because the vulnerability requires no prior authentication or specialized privileges, the attack vector is exposed externally over the network to any unauthenticated visitor interacting with the targeted web application.\nExploitation relies on the application's failure to adequately sanitize or encode user-supplied input before rendering it back to the client. The risk implications are severe, particularly if an administrative user falls victim to the injected payload, potentially leading to total compromise of the underlying WordPress installation through malicious plugin installation or direct code execution.\nRemediation requires updating the Rank Math SEO plugin beyond the affected version range as soon as vendor patches become available, alongside deploying strict Content Security Policy (CSP) headers to mitigate potential script execution vectors.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated Cross-Site Scripting (XSS) flaw residing within the Rank Math SEO plugin for WordPress, specifically impacting versions 1.0.274.1 and prior.\nThe root cause of the vulnerability stems from insufficient input sanitization and output encoding of user-supplied parameters handled by the plugin. When the web application processes incoming HTTP requests, it fails to properly neutralize malicious HTML or JavaScript payloads before reflecting them in the HTTP response body.\nNetwork exposure is fully external, as the vulnerable endpoints are accessible over standard HTTP/HTTPS protocols without requiring any pre-existing authentication credentials or session state. Consequently, any remote attacker can craft and deliver a malicious payload directly to the application.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious Uniform Resource Locator (URL) or HTTP request containing an embedded JavaScript payload designed to execute within the Document Object Model (DOM) of a victim's browser. Second, the attacker induces a targeted user—such as an administrator or regular site visitor—to click the malicious link or visit the crafted URL. Third, the vulnerable Rank Math SEO component processes the input parameter and reflects it unsanitized within the generated HTML response. Fourth, the victim's browser parses the HTTP response, interprets the injected payload as legitimate executable script code, and executes it within the security context of the victim's session.\nPayload behavior during post-exploitation can vary depending on the attacker's objectives and the privileges of the victim. If the victim holds administrative privileges, the executing script can perform privileged actions via the WordPress REST API or administrative dashboard, such as creating new rogue administrator accounts, modifying system settings, injecting persistent backdoors into theme or plugin files, or redirecting site traffic to malicious external destinations. For standard users, the payload may harvest session cookies, capture keystrokes, or exfiltrate sensitive local storage data.\nPrivilege requirements for exploitation are non-existent, as the flaw is entirely unauthenticated, lowering the barrier to entry for automated vulnerability scanners and malicious actors alike."
}