The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125948: wpzoom Recipe Card Blocks Lite: The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text'…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-125409: wpchill Passster – Password Protect Pages and Content: The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-125055: sameh101: The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-123769: brainstormforce: The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all…8.8 HighN/AN/ANov 13, 2026
CVE-2026-122227: mervb1 Easy Property Listings: The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-122063: contrid Newsletters: The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-121518: ivole Customer Reviews for WooCommerce: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-120658: codename065 Download Manager: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-120573: etruel WPeMatico RSS Feed Fetcher: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-120547: saadiqbal: The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is…4.4 MediumN/AN/ANov 13, 2026
CVE-2026-119077: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-118191: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file…8.1 HighN/AN/ANov 13, 2026
CVE-2026-116615: marketingfire Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets: The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is…8.8 HighN/AN/ANov 13, 2026
CVE-2026-116614: aukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping: The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is…4.9 MediumN/AN/ANov 13, 2026
CVE-2026-116509: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-116433: Dell PowerScale InsightIQ: Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability4.3 MediumN/AN/ANov 13, 2026
CVE-2026-112181: OpenKM OpenKM Community Edition: Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community EditionN/A8.3 HighN/ANov 13, 2026
CVE-2026-103645: qt: An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core…N/A1.1 LowN/ANov 13, 2026
CVE-2025-71463: secdev scapy: Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows…6.7 Medium5.4 MediumN/ANov 13, 2026
CVE-2025-71462: diced zipline: Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2025-71461: diced zipline: Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2025-71460: diced zipline: Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2025-71459: diced zipline: Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files…8.1 High7.2 HighN/ANov 13, 2026
CVE-2024-58405: diced zipline: Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which…8.6 High8.8 HighN/ANov 13, 2026
CVE-2024-58404: diced zipline: Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via…7.7 High8.3 HighN/ANov 13, 2026
476-500 of 532044