CVE-2026-104754CWE-79cross-site-scripting

CVE-2026-104754

Low · published October 10, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-10T10:16Z
References (1)
https://wpscan.com/vulnerability/bd680571-b6de-446d-b503-2d36b8ffc7f0/ · [email protected]
EPSS history
Timeline
  • 11 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 10 OCT 06:00Z
    Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
    cvelistv5
  • 10 OCT 06:00Z
    Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
    cvelistv5