The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110290: ajay WebberZone Top 10 — Popular Posts: The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-110252: etruel WPeMatico RSS Feed Fetcher: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-110191: Unknown Product Delivery Date for WooCommerce: The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110179: Unknown affiliate-toolkit: The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-110135: Unknown OTP Login & Register Woocommerce: The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password…7.4 HighN/A0%Oct 16, 2026
CVE-2026-110039: Unknown Smush: The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network…2.7 LowN/A0%Oct 16, 2026
CVE-2026-110015: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API…8.8 HighN/A0%Oct 16, 2026
CVE-2026-110014: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110013: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure…4.8 MediumN/A0%Oct 16, 2026
CVE-2026-110012: Unknown Salon Booking System: The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-109982: Unknown MB Custom Post Types & Custom Taxonomies: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or…4.2 MediumN/A0%Oct 16, 2026
CVE-2026-109401: smub WP Mail Logging: The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…2.7 LowN/A0%Oct 16, 2026
CVE-2026-109388: hivepress: The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-109382: bilalnaseer: The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-109193: hivepress: The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107770: tigroumeow Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-107768: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107646: realmag777 HUSKY – Products Filter for WooCommerce Professional: The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-105974: Unknown Visual Form Builder: The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-105973: Unknown Visual Form Builder: The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-104755: aresit WP Compress – Instant Performance & Speed Optimization: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation…4.8 MediumN/A0%Oct 16, 2026
CVE-2026-104730: sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-104715: Red Hat: A flaw was found in cifs-utils7.8 HighN/A0%Oct 16, 2026
CVE-2026-103696: Unknown Mobile builder: The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL…6.8 MediumN/A0%Oct 16, 2026
CVE-2026-96570: magazine3 Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/A0%Oct 16, 2026
451-475 of 515062
‹›