CVE-2026-104754: Rank Math SEO WordPress Plugin XSS Flaw

CVE-2026-104754 Overview

CVE-2026-104754 is a stored Cross-Site Scripting (XSS) vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.280. The plugin fails to escape the redirection source value before rendering it in an administrative list view. Users authorized to manage redirections, which includes Administrators by default, can inject JavaScript that executes in the browser of any user who later opens that view. On WordPress multisite installations, the payload can execute in the context of a Super Administrator, enabling privilege escalation across the network. The flaw is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated Administrators can inject persistent JavaScript that executes against Super Administrators on multisite WordPress deployments.

Affected Products

Rank Math SEO WordPress plugin versions prior to 1.0.280
WordPress single-site installations with the plugin enabled
WordPress multisite installations where Super Administrators access the redirections view

Discovery Timeline

2026-10-10 - CVE-2026-104754 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104754

Vulnerability Analysis

The vulnerability resides in the Redirections module of the Rank Math SEO plugin. The module accepts a redirection source value from an authenticated user with the capability to manage redirections. The plugin stores this value and renders it inside an administrative list view without applying output escaping. Any HTML or JavaScript included in the source field is interpreted by the browser when an administrator loads the view.

Exploitation requires an attacker to already hold Administrator privileges on the target site. The practical risk emerges on WordPress multisite networks, where site Administrators do not implicitly hold Super Administrator rights. A payload planted by a site Administrator executes with the browser session of any Super Administrator who later reviews the redirections list, enabling account takeover across the network.

Root Cause

The root cause is missing output encoding when rendering stored user-controlled data in the WordPress admin interface. WordPress exposes dedicated escaping helpers such as esc_html() and esc_attr() for this purpose. The plugin writes the stored source value directly into the HTML list view without routing it through these helpers, allowing stored script content to be reflected into the Document Object Model.

Attack Vector

The attack requires an authenticated session with the manage_options or equivalent capability needed to create or edit redirections. The attacker submits a redirection entry whose source field contains a JavaScript payload. The payload is persisted in the plugin's data store. When another privileged user, including a Super Administrator on multisite, opens the redirections view, the browser renders the payload and executes it under the victim's origin and session. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-104754

Indicators of Compromise

Redirection entries in the Rank Math database tables containing <script>, onerror=, onload=, or javascript: substrings in the source URL field
Unexpected new WordPress Administrator or Super Administrator accounts created shortly after a Super Administrator accessed the redirections view
Outbound HTTP requests from administrator browsers to unfamiliar domains after loading the Rank Math admin pages

Detection Strategies

Query the WordPress options and custom plugin tables for redirection rows and inspect the source field for HTML or script syntax
Review WordPress audit logs for redirection create and update events performed by non-trusted Administrator accounts
Monitor web server access logs for POST requests to the Rank Math redirections admin-ajax endpoints followed by unusual admin activity

Monitoring Recommendations

Alert on modifications to WordPress user roles and capabilities immediately following access to /wp-admin/admin.php?page=rank-math-redirections
Deploy a Content Security Policy that reports inline script violations within the WordPress admin to surface injected payloads
Track plugin version inventory across managed WordPress sites to flag any instance running a version below 1.0.280

How to Mitigate CVE-2026-104754

Immediate Actions Required

Upgrade the Rank Math SEO plugin to version 1.0.280 or later on every WordPress site in the environment
Audit all existing redirection entries and remove any whose source field contains HTML tags, event handlers, or script syntax
Review Administrator and Super Administrator account activity for unauthorized changes performed since the vulnerable version was installed

Patch Information

The vendor fixed the issue in Rank Math SEO version 1.0.280 by escaping the redirection source value before output. Refer to the WPScan Vulnerability Report for vendor advisory details and remediation confirmation.

Workarounds

Restrict the capability to manage Rank Math redirections to a small, trusted set of accounts until patching is complete
On multisite networks, instruct Super Administrators to avoid opening the redirections view on sites with untrusted site Administrators until upgrades are applied
Enforce multi-factor authentication for all Administrator and Super Administrator accounts to reduce the blast radius of session compromise

bash

# Verify installed Rank Math SEO version via WP-CLI
wp plugin get seo-by-rank-math --field=version

# Update the plugin to the patched release
wp plugin update seo-by-rank-math --version=1.0.280