The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-62009: ThemeREX Filmax: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62005: ThemeREX Muzicon: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62004: ThemeREX Motorix: Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62003: ThemeREX Mission: Unauthenticated PHP Object Injection in Mission <= 1.22 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61998: ThemeREX Le Truffe: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61997: ThemeREX Legal Stone: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61996: favethemes MLS On The Fly: Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.8.5 HighN/AN/AOct 29, 2026
CVE-2026-61992: Von Eyal Fitoussi GEO my WordPress: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-61991: Ajax Load More AjaxLoadMore Cache: Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.10.0 CriticalN/AN/AOct 29, 2026
CVE-2026-61989: Merv Barrett Easy Property Listings: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54865: Podamibe Nepal Podamibe Custom User Gravatar: Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-54864: nicashmu Post Video Players: Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-54860: ThemeREX Ozisti: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54857: ThemeREX Quirky: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-54856: ThemeREX RexCoin: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-42701: YayCommerce YayMail: Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.7.2 HighN/AN/AOct 29, 2026
CVE-2026-27394: Jyothis Joy Eventer: Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-118085: Global Payments GlobalPayments WooCommerce: Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-97073: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…5.4 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-54871: Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons: Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-54853: Cozmoslabs Profile Builder: Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-54852: miniOrange Page Restriction WordPress (WP): Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-52708: weDevs WP User Frontend: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
851-875 of 418318