The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120579: realmag777 Active Woot Products Tables for WooCommerce. 100% FREE: The Active Woot Products Tables for WooCommerce6.4 MediumN/AN/ANov 7, 2026
CVE-2026-119156: codename065 Download Manager: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name],…7.2 HighN/AN/ANov 7, 2026
CVE-2026-109973: oxilab Flipbox – Awesomes Flip Boxes Image Overlay: The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-96565: cbutlerjr WP-Members Membership Plugin: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-93766: Happyforms Happyforms Pro: The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 7, 2026
CVE-2026-93755: Happyforms Happyforms Pro: The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in…7.2 HighN/AN/ANov 7, 2026
CVE-2026-93429: e4jvikwp VikBooking Hotel Booking Engine & PMS: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 7, 2026
CVE-2026-123776: Improper Validation of Specified Type of InputN/AN/AN/ANov 7, 2026
CVE-2026-123418: andy_moyle Church Admin: The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all…7.2 HighN/AN/ANov 7, 2026
CVE-2026-122231: westguard WS Form LITE – Drag & Drop Contact Form Builder: The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/AN/ANov 7, 2026
CVE-2026-122059: mpol WP ImageViewer: The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt'…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-121977: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-121976: wpchill Modula Image Gallery – Photo Grid & Video Gallery: The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-121765: Cozmoslabs TranslatePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs…7.1 HighN/AN/ANov 7, 2026
CVE-2026-121265: SQL InjectionN/AN/AN/ANov 7, 2026
CVE-2026-120685: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-120683: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-120509: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…4.7 MediumN/AN/ANov 7, 2026
CVE-2026-119498: RelyWP Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119183: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 7, 2026
CVE-2026-119075: themegrill Registration Form for WooCommerce: The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing…9.8 CriticalN/AN/ANov 7, 2026
CVE-2026-118267: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…8.1 HighN/AN/ANov 7, 2026
CVE-2026-118066: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to…9.1 CriticalN/AN/ANov 7, 2026
CVE-2026-118056: oxilab: The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is…4.9 MediumN/AN/ANov 7, 2026
CVE-2026-118050: antoineh Football Pool: The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in…6.4 MediumN/AN/ANov 7, 2026
351-375 of 418627
‹›