The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111409: YITH YITH PayPal Express Checkout for WooCommerce: Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111405: PT Norther Lights Production MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111400: IdeaBox Creations PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111399: PT Norther Lights Production MapSVG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights…8.5 HighN/AN/AOct 16, 2026
CVE-2026-111397: PT Norther Lights Production MapSVG: Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111396: Liquid Web / StellarWP Advanced Post Manager: Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows…7.1 HighN/AN/AOct 16, 2026
CVE-2026-110903: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-110901: WPMU DEV SmartCrawl: Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-110900: Liquid Web / StellarWP BookIt: Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-110896: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-110380: Arraytics WP Event Solution: Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-107564: gocsaf Development Community csaf_provider: An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-105958: Red Hat: A flaw was found in spice-server7.5 HighN/AN/AOct 16, 2026
CVE-2026-111391: sgl-project sglang: SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers…8.1 High9.2 CriticalN/AOct 16, 2026
CVE-2026-111390: erupts erupt: Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data…5.3 Medium6.0 MediumN/AOct 16, 2026
CVE-2026-110029: Unknown Squeeze: The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-109930: Unknown MAIO: The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-107648: switcorp WP Sessions Time Monitoring Full Automatic: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 16, 2026
CVE-2026-105959: Red Hat: A flaw was found in spice-server7.5 HighN/AN/AOct 16, 2026
CVE-2026-109119: ikus-soft rdiffweb: Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows…8.8 HighN/AN/AOct 16, 2026
CVE-2026-109118: ikus-soft rdiffweb: Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore,…4.6 MediumN/AN/AOct 16, 2026
CVE-2026-96768: softaculous GoSMTP Pro: The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body…7.2 HighN/A0%Oct 16, 2026
CVE-2026-14452: Checkmk GmbH Checkmk: Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51…N/A8.6 High0%Oct 16, 2026
CVE-2026-110703: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-107649: liedekef Events Made Easy: The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]'…5.4 MediumN/A0%Oct 16, 2026
376-400 of 507321
‹›