The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125776: Cozmoslabs Profile Builder: Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: social-pug: CVE-2026-125767: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: instagram-widget-by-wpzoom: CVE-2026-125766: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: sureforms: CVE-2026-125763: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125762: LeapWorx Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125746: ProPluginsLab Back In Stock Notifier for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In…5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: addon-elements-for-elementor-page-builder: CVE-2026-125743: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: bdthemes-element-pack-lite: CVE-2026-125708: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: content-protector: CVE-2026-125454: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125450: Brainstorm Force SureRank: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: kali-forms: CVE-2026-125448: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125446: WisdmLabs Edwiser Bridge: Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-125445: Infomaniak Network VOD Infomaniak: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site…4.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: the-post-grid: CVE-2026-125436: Missing Authorization4.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: powerpack-lite-for-elementor: CVE-2026-125435: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125433: FuturioWP Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125431: Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce…5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: mediavine-create: CVE-2026-125046: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125045: John-Michael L'Allier Create: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124745: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124744: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124496: Apache Software Foundation Apache Storm: The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation…N/AN/AN/ANov 11, 2026
CVE-2026-124495: Apache Software Foundation Apache Storm: When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as…N/AN/AN/ANov 11, 2026
WordPress Plugin: wp-job-portal: CVE-2026-124417: Missing Authorization4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124416: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
901-925 of 422975