The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125810: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-125809: myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125808: HTMega HT Mega: Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125807: HTMega HT Mega: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125802: Brainstorm Force Spectra: Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125794: hupe13 Extension for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125792: Andy Moyle Church Admin: Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125783: madalin.ungureanu Custom Post Types and Custom Fields creator – WCK: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125452: Denishua WPJAM Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125440: Cristián Lávaque s2Member: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125432: RelyWP reCAPTCHA for WooCommerce: Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-124970: WP BASE WP BASE Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE…9.3 CriticalN/AN/ANov 13, 2026
CVE-2026-124965: rtCamp Inc.: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124420: Themeisle Woody ad snippets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124418: Ahmad WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124415: Alejandro Alex Reservations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex…9.3 CriticalN/AN/ANov 13, 2026
CVE-2026-124414: VideoWhisper.com Broadcast Live Video: Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-124412: eLightUp Slim SEO: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-124410: wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124409: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-124272: Dimitri Grassi Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi…7.1 HighN/AN/ANov 13, 2026
CVE-2026-124267: Noor Alam Gmail SMTP: Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/ANov 13, 2026
CVE-2026-124265: Tribulant Software Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant…8.5 HighN/AN/ANov 13, 2026
CVE-2026-124260: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/AN/ANov 13, 2026
CVE-2026-123975: Grid Community Forum: Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in…7.5 High8.7 HighN/ANov 13, 2026
251-275 of 532044