Rank Math SEO with AI Best SEO Tools Vulnerability – Authenticated Stored Cross-Site Scripting via ‘titleWrapper’ – CVE-2024-3665 | WordPress Plugin Vulnerability Report

Plugin Name: Rank Math SEO with AI Best SEO Tools

Key Information:

  • Software Type: Plugin
  • Software Slug: seo-by-rank-math
  • Software Status: Active
  • Software Author: rankmath
  • Software Downloads: 94,115,243
  • Active Installs: 2,000,000
  • Last Updated: May 6, 2024
  • Patched Versions: 1.0.217
  • Affected Versions: <= 1.0.216

Vulnerability Details:

  • Name: Rank Math SEO with AI SEO Tools <= 1.0.216
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-3665
  • CVSS Score: 6.4
  • Publicly Published: April 22, 2024
  • Researcher: wesley
  • Description: The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up to, and including, 1.0.216 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


The Rank Math SEO with AI Best SEO Tools plugin for WordPress has a vulnerability in versions up to and including 1.0.216 that allows for stored cross-site scripting through the 'titleWrapper' attribute in its HowTo and FAQ widgets. This vulnerability has been patched in version 1.0.217.

Detailed Overview:

The vulnerability identified by researcher wesley affects the 'titleWrapper' attribute within the HowTo and FAQ widgets of the Rank Math SEO with AI SEO Tools plugin. This flaw arises from insufficient sanitization of input and inadequate escaping of output, allowing attackers with at least contributor privileges to inject and execute malicious scripts. Such vulnerabilities pose significant risks including unauthorized data access and manipulation, which could undermine the security and functionality of the affected websites. The patch in version 1.0.217 addresses these issues, preventing further exploitation.

Advice for Users:

Immediate Action: Users are strongly encouraged to update to version 1.0.217 immediately to close this security loophole. Check for Signs of Vulnerability: Webmasters should review their site logs and widget settings for any unusual activities or unrecognized changes to detect potential exploits. Alternate Plugins: While the current vulnerability has been addressed, users might consider evaluating other SEO plugins that have robust security measures in place as a precautionary measure. Stay Updated: It is crucial to keep all software, especially widely-used plugins like Rank Math SEO, updated to the latest versions to protect against known vulnerabilities.


The prompt action by Rank Math SEO's developers to release a patch for this vulnerability highlights the critical importance of timely software updates in maintaining website security. Users should ensure that they are running version 1.0.217 or later to safeguard their WordPress installations against potential security threats.


Detailed Report: 

The digital realm is vast and ever-changing, and with these changes come vulnerabilities that can compromise the security of countless websites. A notable example of such a vulnerability has emerged in the Rank Math SEO with AI Best SEO Tools plugin, demonstrating the critical need for ongoing vigilance and prompt updates. This plugin, essential for SEO efforts and used by over two million websites, was recently found to be susceptible to a severe security flaw, identified as CVE-2024-3665, which compromised user data through stored cross-site scripting.

Detailed Overview:

The 'titleWrapper' component in the HowTo and FAQ widgets of the Rank Math SEO plugin was pinpointed as the weak link through which attackers could introduce malicious scripts. This vulnerability is particularly alarming as it permits the execution of these scripts whenever a webpage is accessed, risking data breaches and unauthorized website modifications. Thankfully, the update to version 1.0.217 rectifies this flaw, thereby neutralizing the immediate threat.

Historical Vulnerability Context:

Since June 2019, the Rank Math SEO plugin has encountered multiple vulnerabilities, emphasizing the necessity for regular software maintenance and updates to prevent potential security lapses.

Conclusion: Staying Ahead of Security Threats

The developers' quick response in patching the CVE-2024-3665 vulnerability in the Rank Math SEO plugin underscores the essential role that proactive software management plays in securing digital assets. For small business owners managing their websites, adopting automated updates and security checks can significantly reduce the risk of exposure to such vulnerabilities. Ensuring that your digital presence is protected through consistent updates is not just good practice—it is a critical component of modern digital operations.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Rank Math SEO with AI Best SEO Tools Vulnerability – Authenticated Stored Cross-Site Scripting via ‘titleWrapper’ – CVE-2024-3665 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment