The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118070: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…7.2 HighN/AN/AOct 31, 2026
CVE-2026-116557: murgroland WP Booking System – Booking Calendar: The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to…9.1 CriticalN/AN/AOct 31, 2026
CVE-2026-116548: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 31, 2026
CVE-2026-116546: wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website: The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-116522: comesio Relevanssi – A Better Search: The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'…7.2 HighN/AN/AOct 31, 2026
CVE-2026-115840: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 31, 2026
CVE-2026-111254: boldgrid W3 Total Cache: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…7.2 HighN/AN/AOct 31, 2026
CVE-2026-111109: pfefferle Webmention: The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag…6.1 MediumN/AN/AOct 31, 2026
CVE-2026-110251: villatheme Revopic – Photo Reviews for WooCommerce: The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all…5.4 MediumN/AN/AOct 31, 2026
CVE-2026-109386: wpmudev: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization…4.3 MediumN/AN/AOct 31, 2026
CVE-2026-109220: addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder: The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object…9.8 CriticalN/AN/AOct 31, 2026
CVE-2026-109217: wpovernight PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure…5.3 MediumN/AN/AOct 31, 2026
CVE-2026-107765: marketingfire Discussion Board – WordPress Forum Plugin: The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in…6.4 MediumN/AN/AOct 31, 2026
CVE-2026-107750: wpovernight PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 31, 2026
CVE-2026-107653: surecart: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &…7.2 HighN/AN/AOct 31, 2026
CVE-2026-94361: Unknown Payable Payment Gateway for WooCommerce: The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an…N/AN/AN/AOct 31, 2026
CVE-2026-92294: brainstormforce Spectra Legacy – Gutenberg Blocks: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file…6.5 MediumN/AN/AOct 31, 2026
CVE-2026-82214: Unknown Quick Event Manager: The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before…N/AN/AN/AOct 31, 2026
CVE-2026-119977: WordPress Foundation WordPress: WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.38.1 HighN/AN/AOct 31, 2026
CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…N/AN/AN/AOct 31, 2026
CVE-2026-118629: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering…N/AN/AN/AOct 31, 2026
CVE-2026-118438: Unknown Firelight Lightbox: The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing…N/AN/AN/AOct 31, 2026
CVE-2026-118437: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded…N/AN/AN/AOct 31, 2026
CVE-2026-118185: Unknown Security Optimizer: The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that…N/AN/AN/AOct 31, 2026
CVE-2026-118184: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the…N/AN/AN/AOct 31, 2026
51-75 of 420934