The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
WordPress Plugin: restropress: CVE-2026-125784: Cross-Site Request Forgery (CSRF)8.8 HighN/AN/ANov 11, 2026
WordPress Plugin: event-post: CVE-2026-125781: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: profile-builder: CVE-2026-125777: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: yith-woocommerce-ajax-search: CVE-2026-125761: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: bold-page-builder: CVE-2026-125680: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: bold-page-builder: CVE-2026-125455: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: b-blocks: CVE-2026-125451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: king-addons: CVE-2026-125444: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: convertkit: CVE-2026-125439: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: computer-repair-shop: CVE-2026-125438: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: simply-schedule-appointments: CVE-2026-125437: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: computer-repair-shop: CVE-2026-125434: Missing Authorization5.4 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-job-portal: CVE-2026-124753: Missing Authorization4.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: bdthemes-element-pack-lite: CVE-2026-124752: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124740: Red Hat: A flaw was found in BusyBox's udhcpc6 DHCPv6 client4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124738: Red Hat: A flaw was found in BusyBox5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: zoloblocks: CVE-2026-124421: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-user-manager: CVE-2026-124413: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-cafe: CVE-2026-124408: Missing Authorization5.4 MediumN/AN/ANov 11, 2026
WordPress Plugin: restrict-user-access: CVE-2026-124271: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124255: Franky Events Made Easy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy…5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: happy-elementor-addons: CVE-2026-123473: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: e2pdf: CVE-2026-122671: Missing Authorization6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: generateblocks: CVE-2026-121773: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.5 MediumN/AN/ANov 11, 2026
WordPress Plugin: viseek-easy-custom-search: CVE-2026-121770: Cross-Site Request Forgery (CSRF)5.4 MediumN/AN/ANov 11, 2026
951-975 of 422975