The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-113813: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check…N/AN/AN/AOct 28, 2026
CVE-2026-113494: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…N/AN/AN/AOct 28, 2026
CVE-2026-113488: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…N/AN/AN/AOct 28, 2026
CVE-2026-113487: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…N/AN/AN/AOct 28, 2026
CVE-2026-113486: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…N/AN/AN/AOct 28, 2026
CVE-2026-113485: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…N/AN/AN/AOct 28, 2026
CVE-2026-111967: Unknown MP3 Audio Player: The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before…N/AN/AN/AOct 28, 2026
CVE-2026-111961: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a…N/AN/AN/AOct 28, 2026
CVE-2026-111960: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of…N/AN/AN/AOct 28, 2026
CVE-2026-111577: Unknown GoSMTP: The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP…N/AN/AN/AOct 28, 2026
CVE-2026-111032: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted…N/AN/AN/AOct 28, 2026
CVE-2026-111031: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a…N/AN/AN/AOct 28, 2026
CVE-2026-111027: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it…N/AN/AN/AOct 28, 2026
CVE-2026-111021: Unknown افزونه پیامک ووکامرس | Persian WooCommerce SMS: The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a…N/AN/AN/AOct 28, 2026
CVE-2026-110691: Unknown WPOrLogin: The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its…N/AN/AN/AOct 28, 2026
CVE-2026-110524: Unknown Copy Anything to Clipboard for WordPress: The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode…N/AN/AN/AOct 28, 2026
CVE-2026-110509: Unknown Essential Addons for Elementor: The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an…N/AN/AN/AOct 28, 2026
CVE-2026-110507: Unknown Page Builder by SiteOrigin: The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to…N/AN/AN/AOct 28, 2026
CVE-2026-110506: Unknown Page Builder by SiteOrigin: The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before…N/AN/AN/AOct 28, 2026
CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…N/AN/AN/AOct 28, 2026
CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…4.8 MediumN/AN/AOct 28, 2026
CVE-2026-107100: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly…N/AN/AN/AOct 28, 2026
CVE-2026-107098: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's…N/AN/AN/AOct 28, 2026
CVE-2026-107097: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using…N/AN/AN/AOct 28, 2026
CVE-2026-106647: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery…N/AN/AN/AOct 28, 2026
451-475 of 417096