The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-105258: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings…N/AN/AN/AOct 29, 2026
CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…N/AN/AN/AOct 29, 2026
CVE-2024-3586: Unknown LetterPress: The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high…N/AN/AN/AOct 29, 2026
CVE-2026-89216: Unknown vTables: The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL…N/AN/AN/AOct 29, 2026
CVE-2026-88928: Unknown PAYCOMET for WooCommerce: The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment…N/AN/AN/AOct 29, 2026
CVE-2026-78396: Unknown Link Library: The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose…N/AN/AN/AOct 29, 2026
CVE-2026-78395: Unknown Link Library: The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when…N/AN/AN/AOct 29, 2026
CVE-2026-115302: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes…N/AN/AN/AOct 29, 2026
CVE-2026-115301: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its…N/AN/AN/AOct 29, 2026
CVE-2026-115300: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…N/AN/AN/AOct 29, 2026
CVE-2026-115299: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…N/AN/AN/AOct 29, 2026
CVE-2026-115282: Unknown Recipe Card Blocks Lite: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering…N/AN/AN/AOct 29, 2026
CVE-2026-96741: mlfactory DSGVO All in one for WP: The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96669: wpscripts Food Store – Online Food Delivery & Pickup: The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96666: vberkel Schema App Structured Data: The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content…7.2 HighN/AN/AOct 29, 2026
CVE-2026-96228: sslplugins SSL Wireless SMS Notification: SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and…8.1 HighN/AN/AOct 29, 2026
CVE-2026-93904: dejanmarkovic: The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic…7.5 HighN/AN/AOct 29, 2026
CVE-2026-93855: brewlabs SendPress Newsletters: The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid'…7.5 HighN/AN/AOct 29, 2026
CVE-2026-93757: wild-apricot Wild Apricot Login: The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account…7.5 HighN/AN/AOct 29, 2026
CVE-2026-42949: Frangoteam: A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809)5.6 MediumN/AN/AOct 29, 2026
CVE-2026-42922: Frangoteam: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-40063: Frangoteam: A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s):…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118426: Octopus Deploy Octopus Server: In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-109516: guruteam Bot for Telegram on WooCommerce: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-66092: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without…N/A4.8 MediumN/AOct 29, 2026
51-75 of 416436