Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
Vulnerability1 · 1 read
CVE-2026-1928
PHP object injection in Rank Math SEO via updateMeta
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Rank Math SEO WordPress plugin deserializes untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object over the network with no user interaction. If a POP chain is present, this can lead to remote code execution by writing a webshell into the uploads directory. All versions through 1.0.276 are affected.
What to do: Apply Rank Math's update for CVE-2026-1928; a fixed version is not stated beyond the affected range through 1.0.276.
| Product | Affected |
|---|---|
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (WordPress plugin) | all versions up to and including 1.0.276 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
- Ecosystems
- WordPress
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H