The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-90965: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in…N/AN/AN/ANov 5, 2026
CVE-2026-90964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email…N/AN/AN/ANov 5, 2026
CVE-2026-90963: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check…N/AN/AN/ANov 5, 2026
CVE-2026-88814: Unknown YITH WooCommerce Gift Cards: The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance…N/AN/AN/ANov 5, 2026
CVE-2026-87856: Unknown Subscriptions for WooCommerce: The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on…N/AN/AN/ANov 5, 2026
CVE-2026-86795: Unknown Community Events: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX…N/AN/AN/ANov 5, 2026
CVE-2026-86442: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied…N/AN/AN/ANov 5, 2026
CVE-2026-85570: Unknown Tutor LMS: The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included…N/AN/AN/ANov 5, 2026
CVE-2026-85351: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before…N/AN/AN/ANov 5, 2026
CVE-2026-85347: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value…N/AN/AN/ANov 5, 2026
CVE-2026-85346: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on…N/AN/AN/ANov 5, 2026
CVE-2026-19256: Unknown All In One Login: The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made…N/AN/AN/ANov 5, 2026
CVE-2026-16304: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the…N/AN/AN/ANov 5, 2026
CVE-2026-123014: iTerm2: iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker…N/A8.7 HighN/ANov 5, 2026
CVE-2026-109150: Unknown WP PageNavi Style: The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF…N/AN/AN/ANov 5, 2026
CVE-2026-107787: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action,…N/AN/AN/ANov 5, 2026
CVE-2026-107786: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting…N/AN/AN/ANov 5, 2026
CVE-2026-107775: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that…N/AN/AN/ANov 5, 2026
CVE-2026-107774: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted…N/AN/AN/ANov 5, 2026
CVE-2026-107773: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly…N/AN/AN/ANov 5, 2026
CVE-2026-105971: Unknown Car Dealer (Dealership) and Vehicle sales: The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated…N/AN/AN/ANov 5, 2026
CVE-2026-105259: Unknown Easy Social Icons: The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file…N/AN/AN/ANov 5, 2026
CVE-2026-100144: Unknown IVPAY payments: The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it…N/AN/AN/ANov 5, 2026
CVE-2025-15702: Unknown Cloud Blocks: The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block…N/AN/AN/ANov 5, 2026
CVE-2025-15701: Unknown Easy Social Icons: The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting…N/AN/AN/ANov 5, 2026
26-50 of 418286
‹›