The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121777: Cool Plugins Cool Formkit Lite: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121579: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-120579: realmag777 Active Woot Products Tables for WooCommerce. 100% FREE: The Active Woot Products Tables for WooCommerce6.4 MediumN/AN/ANov 7, 2026
CVE-2026-119156: codename065 Download Manager: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name],…7.2 HighN/AN/ANov 7, 2026
CVE-2026-109973: oxilab Flipbox – Awesomes Flip Boxes Image Overlay: The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-123861: CrocoBlock JetFormBuilder – Hierarchical Select: Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120839: Magepeople inc. WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.8 HighN/AN/ANov 7, 2026
CVE-2026-120841: Magepeople inc. WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.8 HighN/AN/ANov 7, 2026
CVE-2026-123467: StylemixThemes Motors: Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-122659: WP ManageNinja LLC Fluent Booking: Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-121575: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122660: BAKKBONE Australia FloristPress: Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-123474: LeapWorx Premium Blocks – Gutenberg Blocks for WordPress: Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121775: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123462: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122663: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122041: Themehigh Checkout Field Editor for WooCommerce (Pro): The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of…9.1 CriticalN/AN/ANov 7, 2026
CVE-2026-96565: cbutlerjr WP-Members Membership Plugin: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-93766: Happyforms Happyforms Pro: The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 7, 2026
CVE-2026-93755: Happyforms Happyforms Pro: The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in…7.2 HighN/AN/ANov 7, 2026
CVE-2026-93429: e4jvikwp VikBooking Hotel Booking Engine & PMS: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 7, 2026
CVE-2026-123776: Improper Validation of Specified Type of InputN/AN/AN/ANov 7, 2026
CVE-2026-123418: andy_moyle Church Admin: The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all…7.2 HighN/AN/ANov 7, 2026
CVE-2026-122231: westguard WS Form LITE – Drag & Drop Contact Form Builder: The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/AN/ANov 7, 2026
CVE-2026-122059: mpol WP ImageViewer: The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt'…6.4 MediumN/AN/ANov 7, 2026
51-75 of 425145
‹›