The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-104726: jeroenpeters1986 Name Directory: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-104003: properfraction: The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-101300: Wegow Technologies Wegow: Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of WegowN/A7.1 High0%Oct 16, 2026
CVE-2026-96870: brainstormforce: The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-87111: WPEverest: The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-75903: manuelgalan Vulnity Security: The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…8.1 HighN/A1%Oct 16, 2026
CVE-2026-19621: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-19600: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize…4.5 MediumN/A0%Oct 16, 2026
CVE-2026-19076: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth…4.4 MediumN/A0%Oct 16, 2026
CVE-2026-18799: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18560: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18256: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18223: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the…5.0 MediumN/A0%Oct 16, 2026
CVE-2026-16453: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the…7.1 HighN/A0%Oct 16, 2026
CVE-2026-16251: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-100108: maxfoundry Social Share Buttons: The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-100106: damian-gora FiboSearch – Ajax Search for WooCommerce: The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-97640: smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice): The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)…7.2 HighN/A0%Oct 16, 2026
CVE-2026-97296: Rocketgenius, Inc Gravity Forms: Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object…8.1 HighN/A0%Oct 16, 2026
CVE-2026-96339: Houzez.co Houzez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez…7.1 HighN/A0%Oct 16, 2026
CVE-2026-94388: halfdata Green Popups: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green…9.3 CriticalN/A0%Oct 16, 2026
CVE-2026-94169: Theme-one The Grid: Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command…10.0 CriticalN/A1%Oct 16, 2026
CVE-2026-92553: yaycommerce: The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File…8.8 HighN/A1%Oct 16, 2026
CVE-2026-92427: Unknown Coinsnap Bitcoin Crowdfunding: The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-92115: opajaap WP Photo Album Plus: The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to,…8.8 HighN/A1%Oct 16, 2026
401-425 of 552532
‹›