The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2025-9462: tobias_conrad WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden: The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions…6.5 MediumN/AN/AOct 31, 2026
CVE-2025-11455: tigroumeow: The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…4.3 MediumN/AN/AOct 31, 2026
CVE-2026-90960: seraphinitesoft Seraphinite Accelerator: The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-89270: popupbuilder: The Popup Builder – Create highly converting, mobile friendly marketing popups9.1 CriticalN/AN/AOct 31, 2026
CVE-2026-88942: woobewoo Product Filter for WooCommerce by WBW: The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via…6.1 MediumN/AN/AOct 31, 2026
CVE-2026-120040: wardee Mail logging & Catcher: The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…7.5 HighN/AN/AOct 31, 2026
CVE-2026-120019: boldgrid W3 Total Cache: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…5.4 MediumN/AN/AOct 31, 2026
CVE-2026-11396: woobewoo Product Filter for WooCommerce by WBW: The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-119980: stiofansisland: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is…6.5 MediumN/AN/AOct 31, 2026
CVE-2026-119166: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-119163: teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is…7.5 HighN/AN/AOct 31, 2026
CVE-2026-119162: specialk User Submitted Posts – Enable Users to Submit Posts from the Front End: The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 31, 2026
CVE-2026-119089: supercleanse: The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is…7.2 HighN/AN/AOct 31, 2026
CVE-2026-119065: arosoft Shipping Zones by Drawing for WooCommerce: The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 31, 2026
CVE-2026-118070: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…7.2 HighN/AN/AOct 31, 2026
CVE-2026-116557: murgroland WP Booking System – Booking Calendar: The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to…9.1 CriticalN/AN/AOct 31, 2026
CVE-2026-116548: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 31, 2026
CVE-2026-116546: wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website: The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-116522: comesio Relevanssi – A Better Search: The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'…7.2 HighN/AN/AOct 31, 2026
CVE-2026-115840: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 31, 2026
CVE-2026-111254: boldgrid W3 Total Cache: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…7.2 HighN/AN/AOct 31, 2026
CVE-2026-111109: pfefferle Webmention: The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag…6.1 MediumN/AN/AOct 31, 2026
CVE-2026-110251: villatheme Revopic – Photo Reviews for WooCommerce: The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all…5.4 MediumN/AN/AOct 31, 2026
CVE-2026-109386: wpmudev: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization…4.3 MediumN/AN/AOct 31, 2026
CVE-2026-109220: addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder: The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object…9.8 CriticalN/AN/AOct 31, 2026
26-50 of 418318