CVE-2024-2536 in Rank Math SEO with AI SEO Tools Plugin
Summary
by MITRE • 04/10/2024
The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all versions up to, and including, 1.0.214 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2025
The vulnerability identified as CVE-2024-2536 affects the Rank Math SEO with AI SEO Tools plugin for WordPress, specifically targeting versions up to and including 1.0.214. This represents a critical security flaw that undermines the integrity of WordPress installations by allowing malicious actors to execute persistent cross-site scripting attacks. The vulnerability resides within the HowTo block functionality, which is a core component of the plugin's artificial intelligence enhanced SEO tools. The flaw stems from inadequate input sanitization mechanisms and insufficient output escaping procedures that fail to properly validate and sanitize user-supplied data before it is processed and stored within the WordPress database.
The technical implementation of this vulnerability allows authenticated attackers who possess contributor-level access or higher privileges to exploit the system by injecting malicious scripts into the HowTo block attributes. When these attributes are subsequently rendered on WordPress pages, the injected scripts execute in the context of other users' browsers who access those pages. This stored XSS vulnerability operates through the manipulation of user input fields within the HowTo block configuration interface, where attackers can insert malicious JavaScript code that persists in the database and executes whenever the affected page is loaded. The vulnerability specifically impacts the plugin's handling of attributes associated with the HowTo block, which is designed to create structured content for how-to guides and instructional materials.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including but not limited to session hijacking, credential theft, and data exfiltration. An attacker with contributor-level access can manipulate the plugin's HowTo block functionality to inject scripts that can capture user credentials, redirect users to malicious websites, or even modify content displayed to other users. The persistence of these attacks makes them particularly dangerous since the malicious scripts remain active until manually removed from the database, potentially affecting all users who access pages containing the compromised HowTo blocks. This vulnerability effectively undermines the security model of WordPress installations by providing attackers with a method to compromise user sessions and execute unauthorized actions within the context of legitimate user accounts.
Mitigation strategies for CVE-2024-2536 should prioritize immediate plugin updates to versions that address the identified sanitization and escaping deficiencies. System administrators should implement strict access controls and monitor user activities within WordPress environments, particularly for users with contributor-level privileges or higher. The vulnerability aligns with CWE-79 which describes cross-site scripting flaws resulting from insufficient output escaping and inadequate input validation. From an ATT&CK framework perspective, this vulnerability maps to technique T1548.003 for bypassing user access controls and T1059 for executing malicious code through web applications. Organizations should also consider implementing web application firewalls and content security policies to provide additional layers of protection against such attacks, while conducting thorough security audits to identify any potential exploitation that may have already occurred within their systems.