The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-109512: kitae-park Mang Board: The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-109400: instawp InstaWP Connect – 1-click WP Staging & Migration: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all…7.5 HighN/A0%Oct 16, 2026
CVE-2026-109221: trainingbusinesspros: The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file…8.1 HighN/A1%Oct 16, 2026
CVE-2026-109219: kitae-park Mang Board: The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-109191: extendthemes: The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-107746: teamfunnelkit FunnelKit – Funnel Builder Plugin for WooCommerce Checkout: The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in…7.5 HighN/A0%Oct 16, 2026
CVE-2026-107659: wpchill Modula Image Gallery – Photo Grid & Video Gallery: The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information…7.5 HighN/A0%Oct 16, 2026
CVE-2026-104798: joedolson My Calendar – Accessible Event Manager: The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-103911: wpmudev: The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-103895: cyberlord92: The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication…8.1 HighN/A0%Oct 16, 2026
CVE-2026-103525: wpmanageninja: The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure…7.5 HighN/A0%Oct 16, 2026
CVE-2026-103481: mpol Gwolle Guestbook: The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter…6.1 MediumN/A0%Oct 16, 2026
CVE-2026-101335: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-97339: complianz Complianz GDPR/CCPA Cookie Consent Banner: The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/A0%Oct 16, 2026
CVE-2026-93953: softaculous: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the…8.0 HighN/A0%Oct 16, 2026
CVE-2026-93535: wppool Dark Mode – Improve Accessibility with AI Powered Dark Theme: The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-89280: dokaninc: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-77829: goratech Cooked – Recipe Management: The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer]…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-111451: Wheels Wheels CLI: Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents7.8 HighN/A0%Oct 16, 2026
CVE-2026-111450: Wheels: Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts…5.9 MediumN/A0%Oct 16, 2026
CVE-2026-111449: Wheels: Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default)5.9 MediumN/A0%Oct 16, 2026
CVE-2026-111448: Wheels: Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems3.7 LowN/A0%Oct 16, 2026
CVE-2026-111447: Wheels: Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to…8.1 HighN/A0%Oct 16, 2026
CVE-2026-111446: Wheels: Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when…8.6 HighN/A0%Oct 16, 2026
CVE-2026-111445: Wheels: Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey()…8.1 HighN/A0%Oct 16, 2026
501-525 of 552532
‹›