VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings security & vulnerabilities

seo-by-rank-math— active installsLast vulnerability Oct 27, 2026

No known unpatched vulnerabilities in the latest version

All 36 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
36Known vulnerabilities
  • Critical1
  • High8
  • Medium26
  • Low1
Vulnerabilities per year
2019: 2 vulnerabilities2192020: 3 vulnerabilities3202022: 1 vulnerability1222023: 2 vulnerabilities2232024: 8 vulnerabilities8242025: 4 vulnerabilities4252026: 16 vulnerabilities1626

All Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerabilities

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerabilities
SeverityVulnerabilityCVEPublished
High8.8Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
≤1.0.276Update to 1.0.277
CVE-2026-1928
Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
<1.0.280Update to 1.0.280
CVE-2026-104751
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.0.279Update to 1.0.280
CVE-2026-104754
Medium4.9Authenticated (Administrator+) SQL Injection
≤1.0.279Update to 1.0.280
CVE-2026-104753
High7.2Authenticated (Administrator+) Arbitrary File Upload
≤1.0.279Update to 1.0.280
CVE-2026-104752
Medium4.3Missing Authorization to Authenticated (Author+) SEO Object Updates
<1.0.277Update to 1.0.277
CVE-2026-77784
Medium4.3Authenticated (Author+) Information Exposure
<1.0.277Update to 1.0.277
CVE-2026-77785
Medium4.3Missing Authorization
<1.0.277Update to 1.0.277
CVE-2026-77787
Medium5.3Unauthenticated Information Exposure
<1.0.277Update to 1.0.277
CVE-2026-77783
Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
<1.0.277Update to 1.0.277
CVE-2026-77788
Medium5.3Unauthenticated Password-Protected Post Content Disclosure
<1.0.277.1Update to 1.0.277.1
CVE-2026-77782
Low2.7Missing Authorization
<1.0.277Update to 1.0.277
CVE-2026-77786
High8.8Authenticated (Author+) Remote Code Execution
≤1.0.276Update to 1.0.277
CVE-2026-81757
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.0.274.1Update to 1.0.275
CVE-2026-66702
Medium4.3Missing Authorization
≤1.0.271Update to 1.0.271.1
CVE-2026-34892
Medium5.3Missing Authorization to Unauthenticated Homepage Settings Modification
≤1.0.271Update to 1.0.271.1
CVE-2025-12714
Medium4.3Authenticated (Subscriber+) Information Exposure
≤1.0.252.1Update to 1.0.253
CVE-2025-64351
Medium4.3Missing Authorization
≤1.0.252.1Update to 1.0.253
CVE-2025-64350
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API
≤1.0.235Update to 1.0.236
CVE-2024-13227
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
≤1.0.235Update to 1.0.236
CVE-2024-13229
High7.2.htaccess File Manipulation to Remote Code Execution
≤1.0.231Update to 1.0.232
CVE-2024-11620
Medium6.5Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
≤1.0.228Update to 1.0.229
CVE-2024-9161
High7.2Authenticated (Administrator+) PHP Object Injection
≤1.0.228Update to 1.0.229
CVE-2024-9314
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.0.218Update to 1.0.219
CVE-2024-4627
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.0.218Update to 1.0.219-beta
CVE-2024-4617
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.0.217Update to 1.0.218
CVE-2024-4335
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'
≤1.0.216Update to 1.0.217
CVE-2024-3665
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes
≤1.0.214Update to 1.0.215
CVE-2024-2536
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<1.0.119.1Update to 1.0.119.1
CVE-2023-32600
Medium6.5Authenticated (Contributor+) Local File Inclusion
≤1.0.107.2Update to 1.0.107.3
CVE-2023-23888
Medium5.4Server-Side Request Forgery
≤1.0.95Update to 1.0.95.1
CVE-2022-36376
Medium5.4Missing Authorization
<1.0.42.2Update to 1.0.42.2
—
Critical9.8Privilege Escalation via Unprotected REST API Endpoint
<1.0.41Update to 1.0.41
CVE-2020-11514
High7.4Redirect Creation via Unprotected REST API Endpoint
≤1.0.40Update to 1.0.41
CVE-2020-11515
Medium6.5Authenticated Settings Reset via reset-cmb Parameter
<1.0.27.1Update to 1.0.27.1
CVE-2019-14786
High7.2Cross-Site Scripting
≤1.0.26Update to 1.0.27
—

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: common questions

Does Rank Math SEO – AI SEO Tools to Dominate SEO Rankings have known vulnerabilities?

Yes. VulnCrest Radar lists 36 known vulnerabilities in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: 1 critical, 8 high, 26 medium, 1 low. None are known to affect version null.

How do I check which version of Rank Math SEO – AI SEO Tools to Dominate SEO Rankings I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerability?

CVE-2026-1928, published Oct 27, 2026: Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution. Severity: High (CVSS 8.8).

Is any Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerability listed in CISA KEV?

No. None of the known Rank Math SEO – AI SEO Tools to Dominate SEO Rankings vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?