The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-119523: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119513: Ahmad JS Help Desk: Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119508: Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services: Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119501: BdThemes Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119496: David Lingren Media LIbrary Assistant: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119492: Metaphor Creations, LLC Ditty: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119490: Made with Fuel Ltd. Better Notifications for WP: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119478: StylemixThemes MasterStudy LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-95870: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions…7.5 HighN/A1%Nov 7, 2026
CVE-2026-61990: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-123960: TOTOLINK CA300-PoE: A weakness has been identified in TOTOLINK CA300-PoE 6.2c.8849.9 Critical8.6 High1%Nov 7, 2026
CVE-2026-123959: TOTOLINK CA300-PoE: A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.8849.1 Critical8.5 High1%Nov 7, 2026
CVE-2026-123469: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-123466: LeapWorx Premium Blocks – Gutenberg Blocks for WordPress: Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-123464: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/A0%Nov 7, 2026
CVE-2026-122668: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-121766: Blubrry Podcasting PowerPress Podcasting: Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting…5.4 MediumN/A0%Nov 7, 2026
CVE-2026-121762: Blubrry Podcasting PowerPress Podcasting: Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross…8.8 HighN/A0%Nov 7, 2026
CVE-2026-120853: Brainstorm Force CartFlows: Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-120852: Brainstorm Force CartFlows: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-120850: Elementor Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-120847: Wpmet Metform: Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-120842: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120840: ThemeGrill User Registration: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120548: icopydoc YML for Yandex Market: The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…5.3 MediumN/A0%Nov 7, 2026
376-400 of 522604
‹›