What is GHSA-g27f-vjpx-r83q?

GHSA-g27f-vjpx-r83q is a security advisory published by GitHub Security Advisories with Low severity. The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source...

Which CVE IDs does GHSA-g27f-vjpx-r83q cover?

GHSA-g27f-vjpx-r83q covers the following CVE IDs: CVE-2026-104754. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g27f-vjpx-r83q?

GHSA-g27f-vjpx-r83q has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

GHSA-g27f-vjpx-r83qLowCVSS 3.5

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-104754 →

📋 Description

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104754
https://wpscan.com/vulnerability/bd680571-b6de-446d-b503-2d36b8ffc7f0
https://github.com/advisories/GHSA-g27f-vjpx-r83q