The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-100175: wayneallen-1 Postie: The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all…5.4 MediumN/AN/AOct 28, 2026
CVE-2026-109384: melograno The Innovative Form Builder – IvyForms: The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions…8.8 HighN/AN/AOct 28, 2026
CVE-2026-77188: xootix Waitlist Woocommerce ( Back in stock notifier ): The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-110020: widgetpack Rich Showcase for Google Reviews: The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to,…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-109979: barrykooij Related Posts for WordPress: The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to,…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-111120: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…8.8 HighN/AN/AOct 28, 2026
CVE-2026-104740: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-111372: quantumcloud AI ChatBot for WooCommerce – WoowBot: The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-109978: cozythemes: The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-76058: odefranca PayPal Brasil para WooCommerce: The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,…5.3 MediumN/AN/AOct 28, 2026
CVE-2026-109972: clavaque: The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-111068: justinnealey DesignSetGo: The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all…4.4 MediumN/AN/AOct 28, 2026
CVE-2026-109590: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height'…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-109385: posimyththemes: The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-103996: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-110662: mxchat MxChat – AI Chatbot & Content Generation for WordPress: The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based…7.2 HighN/AN/AOct 28, 2026
CVE-2026-109381: magepeopleteam: The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8…7.2 HighN/AN/AOct 28, 2026
CVE-2026-103370: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-15323: King-Theme Product Designer for WooCommerce WordPress | Lumise: The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in…7.5 HighN/AN/AOct 28, 2026
CVE-2026-115281: Unknown Recipe Card Blocks Lite: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute…N/AN/AN/AOct 28, 2026
CVE-2026-115255: Unknown WP Roster: The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions,…N/AN/AN/AOct 28, 2026
CVE-2026-115225: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group…N/AN/AN/AOct 28, 2026
CVE-2026-115224: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a…N/AN/AN/AOct 28, 2026
CVE-2026-113813: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check…N/AN/AN/AOct 28, 2026
26-50 of 522616