CVE-2024-4335: medium-severity vulnerability in rankmath Rank Math SEO – AI SEO Tools to…
Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.4%
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
rankmath · Rank Math SEO – AI SEO Tools to Dominate SEO RankingsRelated CVEs — rankmath Rank Math SEO – AI SEO Tools to…
In the same product, most dangerous first.
CVE-2024-9161MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and DeleteEPSS 2.1%CVE-2024-9314HIGHRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.8%CVE-2026-1928HIGHRank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code ExecutionEPSS 0.5%CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2024-3665MEDIUMRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'EPSS 0.5%CVE-2024-13229MEDIUMRank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema DeletionEPSS 0.5%