The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-19798: tusharimran: The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-19603: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-19601: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the…4.9 MediumN/A0%Oct 16, 2026
CVE-2026-19541: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-18795: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-18551: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-15222: wpeverest: The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile,…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-111178: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the…4.9 MediumN/A0%Oct 16, 2026
CVE-2026-111069: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110701: codepeople CP Multi View Events Calendar: The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/A0%Oct 16, 2026
CVE-2026-110664: codename065 Premium Packages – Sell Digital Products Securely: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110366: Gemini Labs Site Reviews: Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110290: ajay WebberZone Top 10 — Popular Posts: The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110252: etruel WPeMatico RSS Feed Fetcher: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-110191: Unknown Product Delivery Date for WooCommerce: The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110179: Unknown affiliate-toolkit: The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-110135: Unknown OTP Login & Register Woocommerce: The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password…7.4 HighN/A0%Oct 16, 2026
CVE-2026-110039: Unknown Smush: The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110015: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API…8.8 HighN/A0%Oct 16, 2026
CVE-2026-110014: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110013: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure…4.8 MediumN/A0%Oct 16, 2026
CVE-2026-110012: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-109982: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or…4.2 MediumN/A0%Oct 16, 2026
CVE-2026-109401: smub WP Mail Logging: The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…2.7 LowN/A0%Oct 16, 2026
CVE-2026-109388: hivepress: The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
376-400 of 412906
‹›