Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-104754: Rank Math SEO plugin lets admin inject script via redirects
CVE-2026-104754 · published 9 days ago
Summary
The Rank Math SEO WordPress plugin (versions before 1.0.280) lets someone who can manage URL redirects store malicious JavaScript in the redirect source field. When any administrator opens the redirects list, the script runs in their browser, potentially compromising their session. Update the plugin to version 1.0.280 or later, or remove/clean any suspicious redirect entries, to protect admin accounts.
What to do
- Update unknown rank math seo to version 1.0.280 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | rank math seo | < 1.0.280 |
Original advisory text
Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.5
Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Oct 2026
Updated16 Oct 2026
First seen10 Oct 2026
Track software like this
Free during beta