The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-110533: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…4.9 MediumN/AN/AOct 30, 2026
CVE-2026-96894: wedevs: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 30, 2026
CVE-2026-97638: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure…7.5 HighN/AN/AOct 30, 2026
CVE-2026-118635: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce: The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to…7.5 HighN/AN/AOct 30, 2026
CVE-2026-9239: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-116552: likebtn Like Button Rating ♥ LikeBtn: The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…4.7 MediumN/AN/AOct 30, 2026
CVE-2026-110305: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all…7.5 HighN/AN/AOct 30, 2026
CVE-2026-110001: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment…5.4 MediumN/AN/AOct 30, 2026
CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…8.7 HighN/AN/AOct 30, 2026
CVE-2026-13747: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119176: codepeople CP Multi View Events Calendar: The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject'…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-119619: 37954679 cak-filemanagement-system: A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a0492977.3 High6.9 MediumN/AOct 30, 2026
CVE-2026-62141: WP ManageNinja LLC Fluent CRM: Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-119722: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119721: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119720: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119719: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119718: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119717: up9inc pybars4: pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119716: wbond pybars3: pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119715: nocodb: NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…8.8 High8.7 HighN/AOct 30, 2026
51-75 of 418318