Rank Math SEO CVE-2026-104754

Requires an account able to manage redirections in the Rank Math SEO plugin (Administrators by default), and the attacker must store a crafted redirection source value; the payload then only fires when another user - notably a Super Administrator on a multisite install - opens the redirections administrative list view. Limiting factors: high-privilege authentication is mandatory (not reachable by low-privileged or anonymous users), victim interaction is required (someone must open the admin list view), and the cross-user escalation value is greatest specifically in multisite deployments where a subsite admin can reach a Super Admin session.

This is a genuinely low-priority issue despite being network-facing. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.5) tells a consistent story with the description: exploitation requires an already-high-privileged actor (PR:H - someone who can manage redirections, which is Administrators by default) to plant the stored payload, plus victim interaction (UI:R - a second user must open the redirections list view). No EPSS score, KEV listing, or POC is present in the provided data, so there is no signal of active or probable exploitation. There is no SSVC decision data supplied. The only real-world risk amplifier is the multisite angle: a subsite/network Administrator could use the stored script to escalate into the session of a Super Administrator who opens the view, crossing a trust boundary that the S:U (unchanged scope) rating arguably understates. Signals are coherent - this is a low-CVSS, low-real-risk privilege-boundary XSS, not a broadly exploitable flaw; absence of EPSS/KEV/POC should be read as 'no exploitation signal available,' not as evidence of safety.

On a WordPress multisite, a malicious or compromised subsite Administrator creates a redirection whose source value contains a JavaScript payload, which is stored without escaping. When a Super Administrator later opens the redirections admin list view, the script executes in their authenticated session, enabling actions at that higher privilege level. No public exploit code is identified at time of analysis, and exploitation depends on the victim opening the affected admin page.