The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118097: bPlugins Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash &…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118095: David Lingren Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118092: StylemixThemes MasterStudy LMS: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-118091: WPFunnels Team WPFunnels: Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118088: WPFunnels Team WPFunnels: Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116856: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116850: weDevs Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-116849: bPlugins StreamCast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-116846: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116406: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-116387: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115713: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115712: Elastic Elastic Cloud Enterprise: Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-115711: Elastic Elastic Cloud Enterprise: Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-115709: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…8.2 HighN/AN/AOct 29, 2026
CVE-2026-115708: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…7.2 HighN/AN/AOct 29, 2026
CVE-2026-115707: Elastic Elastic Cloud Enterprise: Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-115706: Elastic Elastic Cloud Enterprise: Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege…6.8 MediumN/AN/AOct 29, 2026
CVE-2026-115610: PublishPress PublishPress Authors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-115605: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-115601: WP Desk Custom Price for WooCommerce: Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-114706: WP Chill Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-114181: Magepeople inc. Taxi Booking Manager for WooCommerce: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/AOct 29, 2026
CVE-2026-110881: Brainstorm Force SureDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-107024: n/a: Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite…N/AN/AN/AOct 29, 2026
326-350 of 538495