Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
seo-by-rank-math · plugin
Known security vulnerabilities for Rank Math SEO – AI SEO Tools to Dominate SEO Rankings. Find out in seconds which version runs on your site with WP Lens.
20 known vulnerabilities
2 critical · 6 exploitable without logging in · 3 with public exploit code · latest Aug 28, 2026
Listed on wordpress.org · latest 1.0.279 · last updated Sep 22, 2026 · 4M+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2022-36376unauthenticated≤ 1.0.95
WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability
- Critical 9.8
CVE-2020-11514unauthenticated
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, includin
- High 8.8
CVE-2023-23888login required≤ 1.0.107.2
WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability
- High 7.2
CVE-2026-81757author+≤ 1.0.276
WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability
- High 7.2
CVE-2024-11620high privilege≤ 1.0.231
WordPress Rank Math SEO plugin <= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerability
- High 7.2
CVE-2024-9314admin≤ 1.0.228
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
- High 7.1
CVE-2026-66702unauthenticated · needs a click≤ 1.0.274.1
WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2024-9161unauthenticated≤ 1.0.228
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
- Medium 6.5
CVE-2026-34892subscriber+≤ 1.0.271
WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability
- Medium 6.4
CVE-2024-4617contributor+≤ 1.0.218
Rank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 6.1
CVE-2020-11515unauthenticated · needs a click
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external
- Medium 5.4
CVE-2024-13227contributor+≤ 1.0.235
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API
- Medium 5.4
CVE-2024-4335contributor+≤ 1.0.217
Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 5.4
CVE-2024-3665contributor+≤ 1.0.216
Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'
- Medium 5.4
CVE-2024-2536contributor+≤ 1.0.214
Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes
- Medium 5.4
CVE-2023-32600contributor+≤ 1.0.119
WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.3
CVE-2025-12714unauthenticated≤ 1.0.271
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification
- Medium 4.3
CVE-2025-64351login required≤ 1.0.252.1
WordPress Rank Math SEO plugin <= 1.0.252.1 - Sensitive Data Exposure vulnerability
- Medium 4.3
CVE-2024-13229contributor+≤ 1.0.235
Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
- Low 3.8
CVE-2025-64350high privilege≤ 1.0.252.1
WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).