What is the CVSS score of CVE-2026-66702?

CVE-2026-66702 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Rank Math SEO are affected by CVE-2026-66702?

Rank Math SEO, a widely-deployed WordPress plugin, contains an unauthenticated cross-site scripting vulnerability that could enable attackers to hijack administrator sessions without requiring login…

How to fix or mitigate CVE-2026-66702?

Within 24 hours, audit all WordPress installations to identify Rank Math plugin presence and version numbers; prioritize disabling the plugin on non-critical sites. Within 7 days, implement Web Application Firewall (WAF) rules configured to block XSS payload patterns, deploy restrictive Content Security Policy (CSP) headers on all affected WordPress instances, and restrict administrator access to trusted IP ranges. Within 30 days, monitor Rank Math's advisory channels for patch release information, evaluate business case for migration to alternative SEO solutions without this vulnerability, and deploy WordPress-level security monitoring to detect XSS exploitation attempts in access logs.

Rank Math SEO CVE-2026-66702

EUVD-2026-53906 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-jvwh-77cj-h26x

WordPress XSS Wordpress Plugin Rank Math Seo

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS mandates victim interaction (UI:R) and changes scope to the browser (S:C); no server-side availability impact applies to client-side script injection.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:39 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.

Technical ContextAI

Rank Math SEO is a WordPress plugin identified by CPE cpe:2.3:a:rank_math_seo:rank_math_seo:*:*:*:*:*:*:*:* that provides on-page SEO analysis, schema markup, and sitemap generation, and claims over two million active installations. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical class for XSS, meaning user-controlled input is reflected or stored and later rendered in an HTML context without adequate encoding or sanitization. The 'Unauthenticated' qualifier indicates the malicious payload can be submitted without holding a WordPress account, pointing to a reflected vector via URL parameters exposed to anonymous visitors or a stored path writable without authentication. WordPress's shared session model is the critical threat amplifier: script execution in an administrator's browser context grants the attacker the same capabilities as the admin - installing plugins, creating accounts, or modifying site content.

RemediationAI

Update Rank Math SEO to the first version released after 1.0.274.1 via the WordPress Plugins dashboard (Dashboard → Plugins → Update Available) or by downloading directly from the WordPress plugin repository. A specific confirmed fixed version number was not present in available intelligence - verify the exact patched release against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-274-1-cross-site-scripting-xss-vulnerability and the Rank Math SEO changelog before deploying. If immediate patching is not feasible, deploy a WAF rule filtering XSS payloads (script tags, event handlers, javascript: URIs) on requests to Rank Math plugin endpoints, accepting the trade-off that aggressive rules may block legitimate plugin requests. As a targeted compensating control, restricting access to the specific vulnerable endpoint or input field identified in the Patchstack advisory is preferable to blanket WAF rules. Sites where administrators regularly access the WordPress dashboard while logged in should treat this as the highest-priority patch given the admin session hijack escalation path.