Seo Local Rank Vulnerabilities

Cross-Site Request Forgery to Unauthorized True Ranker Disconnection vulnerability

CVSS:

4.3

Affected:

up to 2.2.9

Fix:

No patched version reported

Disclosed:

Mar 7, 2026

The True Ranker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.9. This is due to missing nonce validation on the seolocalrank-signout action. This makes it possible for unauthenticated attackers to disconnect the administrator's True Ranker account via a forge...

CVSS:

4.3

Affected:

up to 2.2.9

Fix:

No patched version reported

Disclosed:

Mar 6, 2026

CVE-2026-1085 on NVD →

[en] The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

Affected:

up to 2.2.4

Fixed in:

2.2.4

Disclosed:

Dec 14, 2021

CVE-2021-39312 on NVD →

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

CVSS:

7.5

Affected:

up to 2.2.2

Fixed in:

2.2.4

Disclosed:

Dec 13, 2021

CVE-2021-39312 on NVD →