The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-114691: Red Hat: A flaw was found in the libstdc++ component of GCC5.9 MediumN/AN/AOct 30, 2026
CVE-2026-110732: tigroumeow: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing…7.5 HighN/AN/AOct 30, 2026
CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…8.8 HighN/AN/AOct 30, 2026
CVE-2026-90437: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom…7.2 HighN/AN/AOct 30, 2026
CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118500: coolplugins Cool FormKit Lite – Advanced Form Builder for Elementor: The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118165: Unknown Firelight Lightbox: The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-118101: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-118100: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-118072: Unknown Fraud Prevention For WooCommerce and EDD: The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-118071: Unknown Joinchat: The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an…6.8 MediumN/AN/AOct 30, 2026
CVE-2026-117572: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter…4.1 MediumN/AN/AOct 30, 2026
CVE-2026-117571: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data…8.8 HighN/AN/AOct 30, 2026
CVE-2026-115277: Unknown User Frontend: The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before…4.7 MediumN/AN/AOct 30, 2026
CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…4.4 MediumN/AN/AOct 30, 2026
CVE-2026-114443: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the…7.5 HighN/AN/AOct 30, 2026
CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…7.5 HighN/AN/AOct 30, 2026
CVE-2026-119087: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119059: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-118634: liedekef Events Made Easy: The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-118194: cyberlord92 Page and Post Restriction: The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-104368: webtoffee Export and Import Users and Customers: The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up…8.8 HighN/AN/AOct 30, 2026
CVE-2026-103963: Red Hat: A flaw was found in glib-networking7.5 HighN/AN/AOct 30, 2026
CVE-2026-5461: wpmudev: The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including,…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-96389: Drupal Xray Audit: Missing Authorization vulnerability in Drupal Xray Audit allows Forceful BrowsingN/AN/AN/AOct 30, 2026
376-400 of 418318