The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110012: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-109982: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or…4.2 MediumN/A0%Oct 16, 2026
CVE-2026-109401: smub WP Mail Logging: The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…2.7 LowN/A0%Oct 16, 2026
CVE-2026-109388: hivepress: The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-109382: bilalnaseer: The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-109193: hivepress: The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107770: tigroumeow Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-107768: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107646: realmag777 HUSKY – Products Filter for WooCommerce Professional: The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-105974: Unknown Visual Form Builder: The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-105973: Unknown Visual Form Builder: The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-104755: aresit WP Compress – Instant Performance & Speed Optimization: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation…4.8 MediumN/A0%Oct 16, 2026
CVE-2026-104730: sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-104715: Red Hat: A flaw was found in cifs-utils7.8 HighN/A0%Oct 16, 2026
CVE-2026-103696: Unknown Mobile builder: The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-96570: magazine3 Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/A0%Oct 16, 2026
CVE-2026-95809: optiuser: The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-95686: optiuser: The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-93767: Tainacan: The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via…6.5 MediumN/A1%Oct 16, 2026
CVE-2026-89079: jfarthing84 Theme My Login: The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to,…9.8 CriticalN/A0%Oct 16, 2026
CVE-2026-89051: johndarrel Hide My WP Ghost – Security & Firewall: The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/A0%Oct 16, 2026
CVE-2026-88963: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site…6.1 MediumN/A0%Oct 16, 2026
CVE-2026-85659: ontraport PilotPress: The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to,…8.8 HighN/A0%Oct 16, 2026
CVE-2026-12272: daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent: The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-111458: adulau ssldump: The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509…N/A6.8 Medium0%Oct 16, 2026
451-475 of 552532
‹›