The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-110691: Unknown WPOrLogin: The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its…N/AN/AN/AOct 28, 2026
CVE-2026-110524: Unknown Copy Anything to Clipboard for WordPress: The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode…N/AN/AN/AOct 28, 2026
CVE-2026-110509: Unknown Essential Addons for Elementor: The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an…N/AN/AN/AOct 28, 2026
CVE-2026-110507: Unknown Page Builder by SiteOrigin: The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to…N/AN/AN/AOct 28, 2026
CVE-2026-110506: Unknown Page Builder by SiteOrigin: The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before…N/AN/AN/AOct 28, 2026
CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…N/AN/AN/AOct 28, 2026
CVE-2026-107100: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly…N/AN/AN/AOct 28, 2026
CVE-2026-107098: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's…N/AN/AN/AOct 28, 2026
CVE-2026-107097: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using…N/AN/AN/AOct 28, 2026
CVE-2026-106647: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery…N/AN/AN/AOct 28, 2026
CVE-2026-106003: Unknown Court Reservation: The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce…N/AN/AN/AOct 28, 2026
CVE-2026-106002: Unknown Court Reservation: The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of…N/AN/AN/AOct 28, 2026
CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…N/AN/AN/AOct 28, 2026
CVE-2026-105972: Unknown Menu Cart for WooCommerce: The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data…N/AN/AN/AOct 28, 2026
CVE-2026-104694: Unknown Thrive Automator: The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before…N/AN/AN/AOct 28, 2026
CVE-2026-103688: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…N/AN/AN/AOct 28, 2026
CVE-2026-103382: Unknown Casso Flow: The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment…N/AN/AN/AOct 28, 2026
CVE-2026-103372: Unknown Payconiq: The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning…N/AN/AN/AOct 28, 2026
CVE-2026-103331: Unknown UniPAY Payment Gateway For WooCommerce: The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of…N/AN/AN/AOct 28, 2026
CVE-2026-115522: Google Agent Development Kit (ADK) for Python: Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python…N/A5.3 MediumN/AOct 28, 2026
CVE-2026-104384: EagleCloud Aquila: Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions…N/A8.7 HighN/AOct 28, 2026
CVE-2026-104383: EagleCloud Aquila: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on…N/A9.4 CriticalN/AOct 28, 2026
CVE-2026-99100: Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54…N/AN/AN/AOct 28, 2026
CVE-2026-1928: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in…8.8 HighN/AN/AOct 28, 2026
CVE-2026-118276: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.10.63.5 Low2.0 LowN/AOct 28, 2026
726-750 of 413066