The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111948: Unknown User Profile Builder: The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a…7.1 HighN/AN/AOct 21, 2026
CVE-2026-111947: Unknown Pricing Table WordPress Plugin: The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating…5.5 MediumN/AN/AOct 21, 2026
CVE-2026-111596: Unknown Kliken: Ads + Pixel for Meta: The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-111574: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data…7.5 HighN/AN/AOct 21, 2026
CVE-2026-110982: Unknown AI Engine: The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object…4.9 MediumN/AN/AOct 21, 2026
CVE-2026-110651: Unknown Swift Performance Lite: The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using…6.8 MediumN/AN/AOct 21, 2026
CVE-2026-110523: Unknown WP User Manager: The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force…8.1 HighN/AN/AOct 21, 2026
CVE-2026-110514: Unknown WPZOOM Portfolio Lite: The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before…4.9 MediumN/AN/AOct 21, 2026
CVE-2026-109926: Unknown Productive Commerce: The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions…4.3 MediumN/AN/AOct 21, 2026
CVE-2026-109147: Unknown WP Booking System: The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before…7.1 HighN/AN/AOct 21, 2026
CVE-2026-108073: Unknown SureCart: The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-107790: Unknown HireZoot: The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in…6.8 MediumN/AN/AOct 21, 2026
CVE-2026-107789: Unknown SmartyParcel: The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-107788: Unknown SmartyParcel: The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label…4.3 MediumN/AN/AOct 21, 2026
CVE-2026-107506: Unknown Simple Banner: The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles…7.5 HighN/AN/AOct 21, 2026
CVE-2026-107237: Unknown Backup and Staging by WP Time Capsule: The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks…8.2 HighN/AN/AOct 21, 2026
CVE-2026-107128: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to…5.0 MediumN/AN/AOct 21, 2026
CVE-2026-107127: Unknown Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset…7.5 HighN/AN/AOct 21, 2026
CVE-2026-106932: Unknown Moloni: The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated…6.5 MediumN/AN/AOct 21, 2026
CVE-2026-105999: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-105998: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-105996: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source…4.8 MediumN/AN/AOct 21, 2026
CVE-2026-105992: Unknown Ettrick Escape Room Booking: The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-105262: Unknown Falang multilanguage for WordPress: The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term…8.0 HighN/AN/AOct 21, 2026
CVE-2026-105257: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is…2.7 LowN/AN/AOct 21, 2026
351-375 of 417319
‹›