The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-77871: saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer: The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-77188: xootix Waitlist Woocommerce ( Back in stock notifier ): The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-76780: rankingcoach: The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.66.3 MediumN/AN/AOct 28, 2026
CVE-2026-76058: odefranca PayPal Brasil para WooCommerce: The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,…5.3 MediumN/AN/AOct 28, 2026
CVE-2026-76005: chuck1982 WP Inventory Manager: The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-63286: Axis Communications AB: Database backups are vulnerable to offline attacks7.1 HighN/AN/AOct 28, 2026
CVE-2026-2839: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering…5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118169: wpmudev: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site…4.9 MediumN/AN/AOct 28, 2026
CVE-2026-118164: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-116761: jtsternberg CMB2: The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field…5.4 MediumN/AN/AOct 28, 2026
CVE-2026-116750: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid'…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116749: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-116610: hornero Clean Login: The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-111372: quantumcloud AI ChatBot for WooCommerce – WoowBot: The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-111213: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-111120: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…8.8 HighN/AN/AOct 28, 2026
CVE-2026-111111: bdthemes: The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable…7.2 HighN/AN/AOct 28, 2026
CVE-2026-111068: justinnealey DesignSetGo: The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all…4.4 MediumN/AN/AOct 28, 2026
CVE-2026-110662: mxchat MxChat – AI Chatbot & Content Generation for WordPress: The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based…7.2 HighN/AN/AOct 28, 2026
CVE-2026-110185: bitpressadmin: The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for…5.9 MediumN/AN/AOct 28, 2026
CVE-2026-110071: kitae-park Mang Board: The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-110020: widgetpack Rich Showcase for Google Reviews: The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to,…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-109988: acowebs Product Addons for Woocommerce – Product Options with Custom Fields: The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored…4.4 MediumN/AN/AOct 28, 2026
CVE-2026-109980: barrykooij Related Posts for WordPress: The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up…4.3 MediumN/AN/AOct 28, 2026
451-475 of 417096