CVE-2024-4617 is a stored cross-site scripting vulnerability in the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings WordPress plugin, affecting versions up to 1.0.218. The vulnerability is due to improper neutralization of input in the 'id' parameter, allowing authenticated users with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute when other users access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. When other users view these pages, the scripts execute in their browsers, potentially leading to information disclosure or session compromise. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin version. Monitor for updates from the vendor to apply an official fix once released.