The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-123661: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-123657: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123656: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule…N/AN/AN/ANov 11, 2026
CVE-2026-123134: Unknown Smoove abandoned cart trigger for WooCommerce: The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape…8.8 HighN/AN/ANov 11, 2026
CVE-2026-122087: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the…3.7 LowN/AN/ANov 11, 2026
CVE-2026-122061: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121998: Unknown iChart: The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121873: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121870: Unknown Simpler Checkout: The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its…7.5 HighN/AN/ANov 11, 2026
CVE-2026-121863: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them…7.1 HighN/AN/ANov 11, 2026
CVE-2026-121862: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-121472: Unknown AutomatorWP: The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration…5.0 MediumN/AN/ANov 11, 2026
CVE-2026-119531: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…5.9 MediumN/AN/ANov 11, 2026
CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119035: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119033: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post…2.2 LowN/AN/ANov 11, 2026
CVE-2026-119032: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118439: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side…4.1 MediumN/AN/ANov 11, 2026
CVE-2026-118420: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118241: Unknown Smush: The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media…2.7 LowN/AN/ANov 11, 2026
CVE-2026-118041: Unknown Contest Gallery: The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce…8.8 HighN/AN/ANov 11, 2026
251-275 of 511254