Rank Math SEO - AI SEO Tools to Dominate SEO Rankings vulnerabilities

Known security issues in the Rank Math SEO - AI SEO Tools to Dominate SEO Rankings WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: seo-by-rank-math
Latest version: 1.0.280
Active installs: 4,000,000+
Known vulnerabilities: 39
Data updated: 2026-10-17 08:40 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 1.0.280 (4)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.280
Vulnerability	Severity	CVSS	Affected versions	Published
[en] The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it. CVE-2026-104751 · Source	Not rated	-	< 1.0.280	2026-10-14
[en] The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store Ja CVE-2026-104754 · Source	Not rated	-	< 1.0.280	2026-10-10
[en] The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks. CVE-2026-104753 · Source	Not rated	-	< 1.0.280	2026-10-10
[en] The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code CVE-2026-104752 · Source	Not rated	-	< 1.0.280	2026-10-10

Fixed in version 1.0.277.1 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.277.1
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure CVE-2026-77782 · Source	Not rated	-	< 1.0.277.1	2026-09-02

Fixed in version 1.0.277 (7)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.277
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution CVE-2026-81757 · Source	High	7.2	< 1.0.277	2026-08-28
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite CVE-2026-77788 · Source	Not rated	-	< 1.0.277	2026-09-02
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization CVE-2026-77787 · Source	Not rated	-	< 1.0.277	2026-09-02
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure CVE-2026-77785 · Source	Not rated	-	< 1.0.277	2026-09-02
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) SEO Object Updates CVE-2026-77784 · Source	Not rated	-	< 1.0.277	2026-09-02
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Unauthenticated Information Exposure CVE-2026-77783 · Source	Not rated	-	< 1.0.277	2026-09-02
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization CVE-2026-77786 · Source	Not rated	-	< 1.0.277	2026-08-27

Fixed in version 1.0.275 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.275
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66702 · Source	High	7.1	< 1.0.275	2026-07-31

Fixed in version 1.0.271.1 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.271.1
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization CVE-2026-34892 · Source	Medium	6.5	< 1.0.271.1	2026-06-03
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification CVE-2025-12714 · Source	Medium	5.3	< 1.0.271.1	2026-05-28

Fixed in version 1.0.253 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.253
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO <= 1.0.252.1 - Authenticated (Subscriber+) Information Exposure CVE-2025-64351 · Source	Medium	4.3	< 1.0.253	2025-09-11
Rank Math SEO <= 1.0.252.1 - Missing Authorization CVE-2025-64350 · Source	Low	3.8	< 1.0.253	2025-09-11

Fixed in version 1.0.236 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.236
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Rank Math SEO Plugin <= 1.0.235 is vulnerable to Cross Site Scripting (XSS) CVE-2024-13227 · Source	Medium	6.4	< 1.0.236	2025-02-12
Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion CVE-2024-13229 · Source	Medium	4.3	< 1.0.236	2025-02-12

Fixed in version 1.0.232 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.232
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Rank Math SEO Plugin <= 1.0.231 is vulnerable to Remote Code Execution (RCE) CVE-2024-11620 · Source	High	7.2	< 1.0.232	2024-11-22

Fixed in version 1.0.229 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.229
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection CVE-2024-9314 · Source	High	7.2	< 1.0.229	2024-10-04
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete CVE-2024-9161 · Source	Medium	6.5	< 1.0.229	2024-10-04

Fixed in version 1.0.219 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.219
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS) CVE-2024-4617 · Source	Medium	6.4	< 1.0.219	2024-05-15
Rank Math SEO <= 1.0.218 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-4627 · Source	Medium	5.4	< 1.0.219	2024-06-11

Fixed in version 1.0.218 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.218
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4335 · Source	Medium	5.4	< 1.0.218	2024-05-03

Fixed in version 1.0.217 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.217
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper' CVE-2024-3665 · Source	Medium	5.4	< 1.0.217	2024-04-22

Fixed in version 1.0.215 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.215
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes CVE-2024-2536 · Source	Medium	5.4	< 1.0.215	2024-03-21

Fixed in version 1.0.119.1 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.119.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Rank Math SEO Plugin <= 1.0.107.2 is vulnerable to Local File Inclusion CVE-2023-23888 · Source	High	7.6	< 1.0.119.1	2023-01-30
Rank Math SEO <= 1.0.119 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-32600 · Source	Medium	6.5	< 1.0.119.1	2023-07-17

Fixed in version 1.0.95.1 (1)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.95.1
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO <= 1.0.95 - Server-Side Request Forgery CVE-2022-36376 · Source	Medium	6.8	< 1.0.95.1	2022-08-12

Fixed in version 1.0.42.2 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.42.2
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO <= 1.0.42.1 - Missing Authorization No CVE assigned · Source	Not rated	-	< 1.0.42.2	2020-04-18
Rank Math 0.9~1.0.42.1 - Authenticated Missing Access Controls to Disable Competitor Plugins No CVE assigned · Source	Not rated	-	< 1.0.42.2	-

Fixed in version 1.0.27.1 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.27.1
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO <= 1.0.27 - Authenticated Settings Reset via reset-cmb Parameter CVE-2019-14786 · Source	Medium	6.5	< 1.0.27.1	2019-06-21
WordPress SEO By Rank Math plugin <= 1.0.27 - Authenticated Settings Reset vulnerability No CVE assigned · Source	Not rated	-	< 1.0.27.1	2019-06-25

Fixed in version 1.0.27 (3)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.27
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress SEO by Rank Math plugin <= 1.0.26 - Cross-Site Scripting (XSS) vulnerabilities No CVE assigned · Source	Not rated	-	< 1.0.27	2019-06-18
Rank Math SEO <= 1.0.26 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 1.0.27	2019-06-18
Seo by Rank Math <= 1.0.26 - XSS Issues No CVE assigned · Source	Not rated	-	< 1.0.27	-

Fixed in version 1.0.0.41 (2)

Rank Math SEO - AI SEO Tools to Dominate SEO Rankings: Fixed in version 1.0.0.41
Vulnerability	Severity	CVSS	Affected versions	Published
Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint CVE-2020-11514 · Source	Critical	9.8	< 1.0.0.41	2020-03-25
Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint CVE-2020-11515 · Source	Medium	6.1	< 1.0.0.41	2020-03-25

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.