WordPress plugin · seo-by-rank-math
Is Rank Math SEO safe?
Safe on 1.0.280 or newer.
The current version, 1.0.280, is past every affected range on record (33 of 33 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 33
- High or critical
- 8
- Exploited
- none
- Current version
- 1.0.280
- Last updated
- Oct 6, 2026
- Active installs
- 4,000,000+
Every recorded flaw
- Oct 28, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2026-1928 · affects up to 1.0.276 · reported by WordfenceHigh 8.8
- Oct 14, 2026Rank Math SEO: Does not perform a capability or nonce check before clearing its stored SEO analysis dataCVE-2026-104751 · fixed in 1.0.280 · reported by WPScanMedium 5.3
- Oct 10, 2026Rank Math SEO: Does not escape a stored redirection source value before outputting it in an administrative list viewCVE-2026-104754 · fixed in 1.0.280 · reported by WPScanLow 3.5
- Oct 10, 2026Rank Math SEO: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-104753 · fixed in 1.0.280 · reported by WPScanMedium 4.1
- Oct 10, 2026Rank Math SEO: Does not correctly validate the type of a file uploaded through its settings import featureCVE-2026-104752 · fixed in 1.0.280 · reported by WPScanHigh 7.2
- Sep 2, 2026Rank Math SEO: Does not verify that the metadata row being updated belongs to the object the user was authorised againstCVE-2026-77788 · fixed in 1.0.277 · reported by WPScanMedium 4.9
- Sep 2, 2026Rank Math SEO: Does not perform a capability checkCVE-2026-77787 · fixed in 1.0.277 · reported by WPScanLow 2.7
- Sep 2, 2026Rank Math SEO: Does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadataCVE-2026-77785 · fixed in 1.0.277 · reported by WPScanLow 2.7
- Sep 2, 2026Rank Math SEO: Does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadataCVE-2026-77784 · fixed in 1.0.277 · reported by WPScanLow 2.7
- Sep 2, 2026Rank Math SEO: Does not verify that the post whose schema it renders on the front end is publicly viewableCVE-2026-77783 · fixed in 1.0.277 · reported by WPScanLow 3.7
- Sep 2, 2026Rank Math SEO: Does not check whether a post is password protected before using its content to build publicly generated SEO metadataCVE-2026-77782 · fixed in 1.0.277.1 · reported by WPScanMedium 5.3
- Aug 29, 2026Rank Math SEO: Does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changedCVE-2026-77786 · fixed in 1.0.277 · reported by WPScanMedium 4.9
- Aug 28, 2026Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-81757 · affects up to 1.0.276 · reported by PatchstackHigh 7.2
- Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.CVE-2026-66702 · affects up to 1.0.274.1 · reported by PatchstackHigh 7.1
- Jun 15, 2026Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.CVE-2026-34892 · affects up to 1.0.271 · reported by PatchstackMedium 6.5
- May 29, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized accessCVE-2025-12714 · affects up to 1.0.271 · reported by WordfenceMedium 5.3
- Oct 31, 2025Rank Math SEO: Insertion of Sensitive Information Into Sent DataCVE-2025-64351 · affects up to 1.0.252.1 · reported by PatchstackMedium 4.3
- Oct 31, 2025Rank Math SEO: Missing AuthorizationCVE-2025-64350 · affects up to 1.0.252.1 · reported by PatchstackLow 3.8
- Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized loss of dataCVE-2024-13229 · affects up to 1.0.235 · reported by WordfenceMedium 4.3
- Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Stored Cross-Site ScriptingCVE-2024-13227 · affects up to 1.0.235 · reported by WordfenceMedium 6.4
- Nov 28, 2024Rank Math SEO: Improper Control of Generation of Code ('Code Injection')CVE-2024-11620 · affects up to 1.0.231 · reported by PatchstackHigh 7.2
- Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2024-9314 · affects up to 1.0.228 · reported by WordfenceHigh 7.2
- Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized modification and loss of dataCVE-2024-9161 · affects up to 1.0.228 · reported by Wordfence2.1% oddsMedium 6.5
- Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · fixed in 1.0.219 · reported by WPScanMedium 5.4
- May 17, 2024Rank Math SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23888 · affects up to 1.0.107.2 · reported by PatchstackHigh 7.6
- May 16, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4617 · affects up to 1.0.218 · reported by WordfenceMedium 6.4
- May 14, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4335 · affects up to 1.0.217 · reported by WordfenceMedium 6.4
- Apr 23, 2024Rank Math SEO with AI SEO Tools: Stored Cross-Site ScriptingCVE-2024-3665 · affects up to 1.0.216 · reported by WordfenceMedium 6.4
- Apr 9, 2024Rank Math SEO with AI SEO Tools: Stored Cross-Site ScriptingCVE-2024-2536 · affects up to 1.0.214 · reported by WordfenceMedium 6.4
- Aug 5, 2023Auth.CVE-2023-32600 · fixed in 1.0.119.1 · reported by PatchstackMedium 6.5
- Sep 9, 2022Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.CVE-2022-36376 · affects up to 1.0.95 · reported by PatchstackMedium 6.8
- Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the uCVE-2020-11515 · affects up to 1.0.40.2 · reported by MITRE2.5% oddsMedium 6.1
- Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · affects up to 1.0.40.2 · reported by MITRE11% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.