CVE-2026-104754

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.280

Description The plugin fails to escape a stored redirection source value before outputting it in an administrative list view. This allows users with redirection management privileges, such as Administrators, to store JavaScript that executes in the session of any user who accesses that view, including Super Administrators on multisite installations. This is a Stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and served to other users.

Recommendations Update Rank Math SEO to version 1.0.280 or later.