The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125680: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125455: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125451: bPlugins B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125444: King Addons King Addons for Elementor: Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125439: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125438: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125437: NSquared Simply Schedule Appointments: Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125434: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-124753: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124752: BdThemes Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124743: Red Hat: A flaw was found in BusyBox5.5 MediumN/AN/ANov 11, 2026
CVE-2026-124740: Red Hat: A flaw was found in BusyBox's udhcpc6 DHCPv6 client4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124738: Red Hat: A flaw was found in BusyBox5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124421: BdThemes ZoloBlocks: Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124413: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124408: Arraytics WPCafe: Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-124271: DEV Institute Restrict User Access – Membership Plugin with Force: Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124255: Franky Events Made Easy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123473: weDevs Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-122671: E2Pdf.com e2pdf: Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-121773: GeneratePress GenerateBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-121770: VillaTheme VISeek: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-121574: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121028: WP Chill Strong Testimonials: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121014: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
226-250 of 511254