The Rank Math SEO plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'textAlign' parameter. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. This vulnerability affects all versions up to 1.0.217. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation guidance is currently available from the vendor.

Exploitation of this vulnerability allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. This can lead to unauthorized actions performed in the context of other users viewing the infected pages, potentially compromising user confidentiality and integrity of the website content. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level permissions to trusted users only and consider disabling or removing the affected plugin if possible. Monitor official Rank Math communications for updates and apply patches promptly once available.