The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111122: gpriday SiteOrigin CSS: The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter…7.2 HighN/A0%Oct 16, 2026
CVE-2026-110017: fullworks Quick PayPal Payments: Payment Button & Form: The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-109513: wpdevteam: The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner &…7.2 HighN/A0%Oct 16, 2026
CVE-2026-109447: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…8.1 HighN/A0%Oct 16, 2026
CVE-2026-109414: appsbd Vitepos – Point of Sale (POS) for WooCommerce: The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-109232: wordpresschef: The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107764: gpriday SiteOrigin CSS: The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107748: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-104932: johnny5 Search Regex: The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of…8.0 HighN/A0%Oct 16, 2026
CVE-2026-104001: rilwis: The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-104000: croixhaug Simply Schedule Appointments: The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status'…7.2 HighN/A0%Oct 16, 2026
CVE-2026-103999: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload…7.2 HighN/A0%Oct 16, 2026
CVE-2026-103896: 10web: The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a…7.5 HighN/A0%Oct 16, 2026
CVE-2026-103768: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-103480: themefic: The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-100186: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…7.2 HighN/A0%Oct 16, 2026
CVE-2026-100158: elvinhaci SQL Chart Builder: The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-96562: wpmudev Broken Link Checker: The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to,…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-111114: posimyththemes: The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to…7.5 HighN/A0%Oct 16, 2026
CVE-2026-111106: getwpfunnels: The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-110721: wpdevteam: The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-110590: klarnaplugin Klarna for WooCommerce: The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…7.5 HighN/A0%Oct 16, 2026
CVE-2026-110019: niklaslindemann Bulk Page Generator – LPagery: The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-109998: kitae-park Mang Board: The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all…7.2 HighN/A0%Oct 16, 2026
CVE-2026-109515: properfraction: The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc9.8 CriticalN/A0%Oct 16, 2026
476-500 of 552532
‹›