The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-123698: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…N/AN/AN/ANov 11, 2026
CVE-2026-123697: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current…N/AN/AN/ANov 11, 2026
CVE-2026-123696: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…N/AN/AN/ANov 11, 2026
CVE-2026-123695: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API…N/AN/AN/ANov 11, 2026
CVE-2026-123667: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names…N/AN/AN/ANov 11, 2026
CVE-2026-123666: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the…N/AN/AN/ANov 11, 2026
CVE-2026-123661: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is…N/AN/AN/ANov 11, 2026
CVE-2026-123657: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking…N/AN/AN/ANov 11, 2026
CVE-2026-123656: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule…N/AN/AN/ANov 11, 2026
CVE-2026-123134: Unknown Smoove abandoned cart trigger for WooCommerce: The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape…N/AN/AN/ANov 11, 2026
CVE-2026-122087: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the…N/AN/AN/ANov 11, 2026
CVE-2026-122061: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays…N/AN/AN/ANov 11, 2026
CVE-2026-121998: Unknown iChart: The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX…N/AN/AN/ANov 11, 2026
CVE-2026-121873: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address…N/AN/AN/ANov 11, 2026
CVE-2026-121870: Unknown Simpler Checkout: The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its…N/AN/AN/ANov 11, 2026
CVE-2026-121863: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them…N/AN/AN/ANov 11, 2026
CVE-2026-121862: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply…N/AN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…N/AN/AN/ANov 11, 2026
CVE-2026-121472: Unknown AutomatorWP: The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration…N/AN/AN/ANov 11, 2026
CVE-2026-119531: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder…N/AN/AN/ANov 11, 2026
CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…N/AN/AN/ANov 11, 2026
CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…N/AN/AN/ANov 11, 2026
CVE-2026-119035: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data…N/AN/AN/ANov 11, 2026
CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…N/AN/AN/ANov 11, 2026
CVE-2026-119033: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post…N/AN/AN/ANov 11, 2026
26-50 of 558928