CVE-2026-66702
Received Received - Intake

Unauthenticated XSS in Rank Math SEO Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-66702
EUVD
EUVD-2026-53906

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rank_math seo to 1.0.274.1 (inc)
rank_math seo_plugin to 1.0.274.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Rank Math SEO plugin for WordPress versions up to 1.0.274.1. It allows attackers to inject malicious scripts into a website by tricking a privileged user into interacting with a harmful link, page, or form submission. The injected scripts could redirect users or display unwanted advertisements.

Detection Guidance

Check if the Rank Math SEO plugin version is <= 1.0.274.1. Use WordPress admin panel to inspect plugin versions or run SQL queries on the database if direct access is unavailable.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject harmful scripts into your website. These scripts might redirect visitors to malicious sites, display intrusive ads, or steal sensitive user data. Successful exploitation requires a privileged user to interact with a crafted link or form, making it easier for attackers to target site administrators or logged-in users.

Mitigation Strategies

Update Rank Math SEO plugin to version 1.0.275 or later immediately. Apply Patchstack's mitigation rule if available to block attacks until the update is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart