The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-109384: melograno The Innovative Form Builder – IvyForms: The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions…8.8 HighN/AN/AOct 28, 2026
CVE-2026-109381: magepeopleteam: The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8…7.2 HighN/AN/AOct 28, 2026
CVE-2026-109370: bplugins Document Embedder – let visitors read files without downloading: The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-109218: kleor Contact Manager: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-108366: wpdevteam: The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-107710: wpmudev: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-104743: Tainacan: The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via…4.9 MediumN/AN/AOct 28, 2026
CVE-2026-104740: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-104729: themefusion Avada (Fusion) Builder: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index,…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-103996: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-103370: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-100175: wayneallen-1 Postie: The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all…5.4 MediumN/AN/AOct 28, 2026
CVE-2026-15323: King-Theme Product Designer for WooCommerce WordPress | Lumise: The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in…7.5 HighN/AN/AOct 28, 2026
CVE-2026-115281: Unknown Recipe Card Blocks Lite: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute…6.8 MediumN/AN/AOct 28, 2026
CVE-2026-115255: Unknown WP Roster: The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions,…5.3 MediumN/AN/AOct 28, 2026
CVE-2026-115225: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group…5.8 MediumN/AN/AOct 28, 2026
CVE-2026-115224: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a…4.1 MediumN/AN/AOct 28, 2026
CVE-2026-113813: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-113494: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…2.7 LowN/AN/AOct 28, 2026
CVE-2026-113488: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…6.8 MediumN/AN/AOct 28, 2026
CVE-2026-113487: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…6.8 MediumN/AN/AOct 28, 2026
CVE-2026-113486: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-113485: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-111967: Unknown MP3 Audio Player: The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before…6.8 MediumN/AN/AOct 28, 2026
CVE-2026-111961: Unknown Royal MCP: The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a…3.8 LowN/AN/AOct 28, 2026
576-600 of 417096