Stored Cross-Site Scripting in Rank Math SEO Plugin for WordPress

CVE-2024-13227

Summary

The Rank Math SEO plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the Rank Math API. This issue arises from inadequate input sanitization and output escaping for user-supplied attributes. Authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which will execute whenever other users access the affected pages. This could potentially lead to the manipulation of site content and unauthorized actions performed within the context of the affected user's session.

References