The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-92998: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using…8.6 HighN/AN/AOct 21, 2026
CVE-2026-92997: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before…8.6 HighN/AN/AOct 21, 2026
CVE-2026-88784: Unknown Translate WordPress with Weglot 2.0: The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a…7.5 HighN/AN/AOct 21, 2026
CVE-2026-87838: Unknown Wava Payment Plugin: The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification…6.5 MediumN/AN/AOct 21, 2026
CVE-2026-87837: Unknown Wava Payment Plugin: The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-86611: Unknown Download Manager: The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…4.3 MediumN/AN/AOct 21, 2026
CVE-2026-85642: Unknown Formidable Forms: The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…7.5 HighN/AN/AOct 21, 2026
CVE-2026-81813: Unknown Elementor Website Builder: The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking…6.8 MediumN/AN/AOct 21, 2026
CVE-2026-81812: Unknown Elementor Website Builder: The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route,…6.4 MediumN/AN/AOct 21, 2026
CVE-2026-79627: Unknown Advanced File Manager: The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG…7.1 HighN/AN/AOct 21, 2026
CVE-2026-71195: OpenStack Manila: In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns…9.9 CriticalN/AN/AOct 21, 2026
CVE-2026-15261: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-111957: Unknown SUMIT Payment Gateway for WooCommerce: The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-111956: Unknown WholesaleX: The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly…5.9 MediumN/AN/AOct 21, 2026
CVE-2026-111955: Unknown WholesaleX: The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before…6.5 MediumN/AN/AOct 21, 2026
CVE-2026-111949: Unknown miniOrange 2FA: The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an…7.5 HighN/AN/AOct 21, 2026
CVE-2026-111948: Unknown User Profile Builder: The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a…7.1 HighN/AN/AOct 21, 2026
CVE-2026-111947: Unknown Pricing Table WordPress Plugin: The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating…5.5 MediumN/AN/AOct 21, 2026
CVE-2026-111596: Unknown Kliken: Ads + Pixel for Meta: The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-111574: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data…7.5 HighN/AN/AOct 21, 2026
CVE-2026-110982: Unknown AI Engine: The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object…4.9 MediumN/AN/AOct 21, 2026
CVE-2026-110651: Unknown Swift Performance Lite: The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using…6.8 MediumN/AN/AOct 21, 2026
CVE-2026-110523: Unknown WP User Manager: The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force…8.1 HighN/AN/AOct 21, 2026
CVE-2026-110514: Unknown WPZOOM Portfolio Lite: The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before…4.9 MediumN/AN/AOct 21, 2026
CVE-2026-109926: Unknown Productive Commerce: The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions…4.3 MediumN/AN/AOct 21, 2026
351-375 of 417319
‹›