The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-91833: Unknown WX Subscribe 微信支付付费订阅: The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-91830: Unknown Subscribe to Comments: The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-74923: Unknown Document Gallery: The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-19867: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-19798: tusharimran: The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-19603: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-19601: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the…4.9 MediumN/A0%Oct 16, 2026
CVE-2026-19541: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-18795: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-18551: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-15222: wpeverest: The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile,…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-111178: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the…4.9 MediumN/A0%Oct 16, 2026
CVE-2026-111069: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110701: codepeople CP Multi View Events Calendar: The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/A0%Oct 16, 2026
CVE-2026-110664: codename065 Premium Packages – Sell Digital Products Securely: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110366: Gemini Labs Site Reviews: Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110290: ajay WebberZone Top 10 — Popular Posts: The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110252: etruel WPeMatico RSS Feed Fetcher: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-110191: Unknown Product Delivery Date for WooCommerce: The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110179: Unknown affiliate-toolkit: The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-110135: Unknown OTP Login & Register Woocommerce: The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password…7.4 HighN/A0%Oct 16, 2026
CVE-2026-110039: Unknown Smush: The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110015: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API…8.8 HighN/A0%Oct 16, 2026
CVE-2026-110014: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110013: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure…4.8 MediumN/A0%Oct 16, 2026
426-450 of 413651
‹›