Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Rank Math SEO 1.0.280 Clear all filters
TI-2026-70258 CVE-2026-104754 · GHSA-g27f-vjpx-r83q

Stored cross-site scripting in Rank Math SEO redirection source URL

Priority LOW 16

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by defau…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00173 Published 2026-10-10 Fixed in 1.0.280 CWE-79
TI-2026-70257 CVE-2026-104753 · GHSA-5qxx-q92p-gx5j

SQL injection in Rank Math SEO plugin via per_page parameter

Priority LOW 19

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00226 Published 2026-10-10 Fixed in 1.0.280 CWE-89
TI-2026-70256 CVE-2026-104752 · GHSA-949x-75hv-69g2

Arbitrary file upload in Rank Math SEO enables remote code execution

Priority LOW 34

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achie…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00506 Published 2026-10-10 Fixed in 1.0.280 CWE-434