Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-18742: UX-themes Flatsome: The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and…6.4 MediumN/A0%Nov 14, 2026
CVE-2026-129181: projectworlds Visitor Management System: A vulnerability has been found in projectworlds Visitor Management System 1.07.3 High5.5 Medium0%Nov 14, 2026
CVE-2026-129319: browserify createECDH: create-ecdh is a browserifiable implementation of Node.js crypto.createECDH5.9 Medium8.2 High0%Nov 14, 2026
CVE-2026-126697: Unknown Quick Page/Post Redirect Plugin: The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that…N/AN/A0%Nov 14, 2026
CVE-2026-126640: Unknown WP Ultimate CSV Importer: The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them…N/AN/A0%Nov 14, 2026
CVE-2026-126639: Unknown: The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do…N/AN/A0%Nov 14, 2026
CVE-2026-124649: Unknown Lightbox with PhotoSwipe: The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption…N/AN/A0%Nov 14, 2026
CVE-2026-123122: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at…N/AN/A0%Nov 14, 2026
CVE-2026-123046: Unknown SEOJuice: The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling…N/AN/A0%Nov 14, 2026
CVE-2026-119258: Unknown Swipe: The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress…N/AN/A0%Nov 14, 2026
CVE-2026-118183: Unknown Duplicate Post: The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one,…N/AN/A0%Nov 14, 2026
CVE-2026-118182: Unknown Duplicate Post: The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it,…N/AN/A0%Nov 14, 2026
CVE-2026-118181: Unknown Duplicate Post: The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings,…N/AN/A0%Nov 14, 2026
CVE-2026-117490: Unknown Flatsome: The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an…N/AN/A0%Nov 14, 2026
CVE-2026-117487: Unknown Flatsome: The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to…N/AN/A0%Nov 14, 2026
CVE-2026-116528: Unknown Chargely Free Subscriptions For Woocommernce: The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check…N/AN/A0%Nov 14, 2026
CVE-2026-111034: Unknown: The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to…N/AN/A0%Nov 14, 2026
CVE-2026-111033: Unknown: The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks…N/AN/A0%Nov 14, 2026
CVE-2026-105984: Unknown Email Marketing 4Dem: The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several…N/AN/A0%Nov 14, 2026
CVE-2026-105983: Unknown Email Marketing 4Dem: The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several…N/AN/A0%Nov 14, 2026
CVE-2026-126173: AutomatorWP AutomatorWP Webhooks: The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to,…9.8 CriticalN/A1%Nov 14, 2026
CVE-2026-124969: optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is…7.1 HighN/A0%Nov 14, 2026
CVE-2026-71531: PrestaShop: PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding…8.1 High8.6 High0%Nov 13, 2026
CVE-2026-71519: PrestaShop: PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated…8.1 High8.6 High0%Nov 13, 2026
CVE-2026-129180: projectworlds Visitor Management System: A flaw has been found in projectworlds Visitor Management System 1.07.3 High5.5 Medium0%Nov 13, 2026
26-50 of 565095