CVE-2026-104754: CWE-79 Cross-Site Scripting (XSS) in Rank Math SEO

CVE-2026-104754 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Rank Math SEO WordPress plugin versions prior to 1.0.280. The vulnerability arises because the plugin does not escape a stored redirection source value before outputting it in an administrative list view. Users with redirection management privileges (Administrators by default) can inject JavaScript code that executes in the context of any user who later accesses that view, potentially leading to session hijacking or other script-based attacks within the admin interface.

An attacker with the ability to manage redirections can inject malicious JavaScript that executes in the browser of any user who views the affected administrative list, including high-privilege users such as Super Administrators on multisite WordPress installations. This could allow the attacker to perform actions on behalf of the victim, steal session tokens, or conduct other malicious activities within the administrative context.

Upgrade the Rank Math SEO plugin to version 1.0.280 or later, where this vulnerability has been fixed. Users should apply this official fix to prevent exploitation. No alternative mitigations are indicated in the available data.