TrueRanker

TrueRanker has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Path Traversal.

Every one of the 2 issues recorded for TrueRanker has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. TrueRanker is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all TrueRanker vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2021-39312

True Ranker <= 2.2.2 - Directory Traversal/Arbitrary File Read

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv3.0.5
4.6(9)
92/100
Last Updated
2026-10-22 (6d ago)
Active Installs
400+
Downloads
13,109
Requires WP
6.6+
Requires PHP
8.0+
Tested up to
WP 7.1.3
Created
2019-08-20 (7y ago)

TrueRanker is the SEO suite for the AI-search era. Its flagship feature in WordPress is the AI Visibility Tracker — a brand radar that shows how ChatGPT, Gemini, Claude, Perplexity, Grok, and DeepSeek mention and cite your brand. Track custom prompts, measure AI visibility score, mentions, citations, sentiment, share of voice, and LLM coverage. Compare competitors and see which engines recommend you (or your rivals). All of that lives in the WordPress admin after you connect your TrueRanker account. You also get daily Google keyword rankings (Rank Tracker) and backlink summaries in the same dashboard. Rankings and deeper reports sync with your TrueRanker account at trueranker.com. The plugin is free and GPL-licensed. TrueRanker offers a 14-day trial with no credit card. AI Visibility Tracker (brand radar) The AI Visibility screen is a first-class WordPress admin page — not a bolted-on link: AI visibility score with breakdown (mention rate, citation rate, sentiment, share of voice, LLM coverage). Mentions and citations across your prompt set, with change vs the previous period. LLM coverage — which of ChatGPT, Claude, Gemini, Perplexity, Grok, and DeepSeek mention your brand, and how often. Competitors and share of voice — see your brand radar against rivals, including share of voice per LLM and over time. Prompt results — a table of prompts by location, presence on each AI engine (mention / citation), sentiment, and trend. Click a row to open the prompt detail modal (engine responses, citations, sentiment, and history). Score trend — score, mentions, and citations over time. AI Visibility Changes — when engines start or stop citing you for a prompt. Add prompts. Add prompts in WordPress: type them (one per line), pick suggested prompts, choose a location, and select which engines to track (ChatGPT, Gemini, Claude, and the rest available on your plan). If you hit your prompt quota, the plugin links to upgrade your TrueRanker plan. Also in this plugin Onboarding. Connect with your TrueRanker API key, or enter your email and TrueRanker sends the key to that address. If several projects match this site, pick one. If none match, create a project for the site domain. Dashboard. KPIs and charts for Rank Tracker, AI Visibility (score, mentions, citations), and backlinks. If SEO audits are enabled on the account, a score summary is shown too. Rank Tracker. Date range, summaries (average position, keyword distribution, AI Overviews), a sortable keyword table, history/SERP snapshot, and add keywords by location and device (desktop, mobile, or both). Settings. Active project and log out. Language. English or Spanish, following the WordPress site language. Other locales fall back to English. In your TrueRanker account These suite tools are available at trueranker.com; they are not separate WordPress admin screens yet: Local SEO tracker (map-pack / geo-grid) Full SEO audit crawler Competitor research beyond the AI Visibility competitor cards White-label and scheduled reports Backlink explorer and disavow workflow External service After you connect, the plugin talks only to https://app.trueranker.com. Nothing is sent until you enter an API key or ask TrueRanker to email one. Terms of use Privacy policy Legal notice Requires PHP 8.0 or higher and WordPress 6.6 or higher. Third-party resources This plugin bundles the following GPL-compatible libraries locally (no CDN): Chart.js 4.5.1 Copyright (c) Chart.js Contributors License: MIT https://github.com/chartjs/Chart.js react-chartjs-2 5.3.1 Copyright (c) Jeremy Ayerst License: MIT https://github.com/reactchartjs/react-chartjs-2 @kurkle/color 0.3.4 (Chart.js dependency) Copyright (c) Jukka Kurkela License: MIT https://github.com/kurkle/color Tabulator 6.5.0 Copyright (c) 2015-2024 Oli Folkerd License: MIT https://github.com/olifolkerd/tabulator Admin UI icons use WordPress Dashicons (GPL) and an original rocket SVG licensed GPL-2.0-or-later with this plugin.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C