CVE-2024-4627

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Rank Math SEO	< 1.0.219
rankmath	seo	< 1.0.219

References

https://wpscan.com/vulnerability/c0058fcc-36f6-40bf-9848-fbe2d751d754/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/c0058fcc-36f6-40bf-9848-fbe2d751d754/Exploit, Third Party Advisory

Timeline

Published: Jul 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-462747.8cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h.CVE-2024-462767.8cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h.CVE-2024-462788.4Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.CVE-2024-462808.8PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a roo CVE-2024-46296.5A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempt CVE-2024-462927.5A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name para CVE-2024-462939.8Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for ad CVE-2024-46306.4The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2024-463006.1itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.CVE-2024-463047.5A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coap_handle_request CVE-2024-463077.5A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.CVE-2024-463109.1Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose