CVE-2023-32600 MEDIUM

CVE-2023-32600: WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)

Vendor Rank Math

Product Rank Math SEO

Weakness CWE-79 · XSS

Published August 5, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Rank Math SEO versions up to 1.0.119 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction—typically clicking a link or visiting a crafted page—but can affect the entire site scope due to the stored nature of the attack.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in other users' browsers, potentially stealing session tokens or performing actions as those users.

Potential impact on your site

04Site Impact

Authenticated users can compromise other users' accounts or sessions, including admin accounts, without requiring admin privileges themselves.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; victim must visit a page containing the injected payload.

Key dates

06Disclosure timeline

August 5, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-32600 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities