The Rank Math SEO plugin prior to version 1.0.280 fails to escape a stored redirection source value before rendering it in the administrative list view. This oversight allows a user with the ability to manage redirections—generally Administrators—to embed arbitrary JavaScript. When any user, including a Super Administrator on a multisite setup, later accesses the list view, the script executes in that user's session, enabling arbitrary client‑side code injection and potential credential theft or session hijacking.

This vulnerability affects installations of the Rank Math SEO WordPress plugin with versions older than 1.0.280. The plugin is distributed by Rank Math, and administrators who enable redirection functionality are granted the capability to trigger the exploit.

The vulnerability is a classic stored cross‑site scripting flaw (CWE-79). The CVSS score of 3.5 indicates a low‑medium severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an authenticated admin adding a malicious script to a redirection source field; the script then runs within the context of any subsequent visitor to the admin list view. Because the flaw persists until a plugin update, the exploit remains feasible against all vulnerable installations until patched.