The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119035: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119033: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post…2.2 LowN/AN/ANov 11, 2026
CVE-2026-119032: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118439: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side…4.1 MediumN/AN/ANov 11, 2026
CVE-2026-118420: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118241: Unknown Smush: The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media…2.7 LowN/AN/ANov 11, 2026
CVE-2026-118041: Unknown Contest Gallery: The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce…8.8 HighN/AN/ANov 11, 2026
CVE-2026-117524: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status…2.7 LowN/AN/ANov 11, 2026
CVE-2026-117523: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-117522: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-117521: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-116081: Fenrir Inc.: Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc4.2 Medium2.3 LowN/ANov 11, 2026
CVE-2026-115735: Unknown Somatic Framework: The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a…9.6 CriticalN/AN/ANov 11, 2026
CVE-2026-115734: Unknown Pay with a tweet: The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it…9.6 CriticalN/AN/ANov 11, 2026
CVE-2026-115733: Unknown Printaura-Woocommerce: The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API,…9.1 CriticalN/AN/ANov 11, 2026
CVE-2026-111597: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-111579: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's…8.1 HighN/AN/ANov 11, 2026
CVE-2026-110949: Unknown Download Manager: The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a…3.7 LowN/AN/ANov 11, 2026
CVE-2026-110948: Unknown Download Manager: The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify…3.7 LowN/AN/ANov 11, 2026
CVE-2026-110016: Unknown Data Tables Generator by Supsystic: The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-109873: Unknown User Registration & Membership: The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-109871: Unknown User Registration & Membership: The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-109870: Unknown User Registration & Membership: The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a…8.1 HighN/AN/ANov 11, 2026
451-475 of 511254