The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118598: GNOME Epiphany: A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user…6.5 MediumN/AN/AOct 31, 2026
CVE-2026-116752: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-109231: vendidero Germanized for WooCommerce: The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation…4.3 MediumN/AN/AOct 31, 2026
CVE-2026-109197: wpdirectorykit WP Directory Kit: The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all…7.5 HighN/AN/AOct 31, 2026
CVE-2026-107711: wppool FlexStock – Product Stock Sync with Google Sheets for WooCommerce: The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-104926: ThemeHigh WooCommerce Extra Product Options Pro: The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…6.1 MediumN/AN/AOct 31, 2026
CVE-2026-100151: kstover: The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…6.1 MediumN/AN/AOct 31, 2026
CVE-2026-117681: A flaw was found in konflux-ci8.0 HighN/AN/AOct 31, 2026
CVE-2026-116964: A flaw was found in konflux-ci8.4 HighN/AN/AOct 31, 2026
CVE-2026-116086: A flaw was found in konflux-ci8.8 HighN/AN/AOct 31, 2026
CVE-2026-114217: A flaw was found in konflux-ci8.6 HighN/AN/AOct 31, 2026
CVE-2026-101325: contrid Newsletters: The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-110530: radgeek FeedWordPress: The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…7.2 HighN/AN/AOct 31, 2026
CVE-2026-120075: melapress WP Activity Log: The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and…7.2 HighN/AN/AOct 31, 2026
CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…9.1 CriticalN/AN/AOct 31, 2026
CVE-2026-119160: shapedplugin: The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-109367: smub: The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-118235: wpazleen: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is…9.8 CriticalN/AN/AOct 31, 2026
CVE-2026-103915: melograno Booking for Appointments and Events Calendar – Amelia: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-120070: wedevs: The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend…8.8 HighN/AN/AOct 31, 2026
CVE-2026-119096: uncannyowl Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and…9.8 CriticalN/AN/AOct 31, 2026
CVE-2026-118057: paultgoodchild: The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is…7.2 HighN/AN/AOct 31, 2026
CVE-2026-116535: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO: The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-116512: wedevs: The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress…9.8 CriticalN/AN/AOct 31, 2026
CVE-2026-111592: publishpress: The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is…6.4 MediumN/AN/AOct 31, 2026
26-50 of 421285