The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120685: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-120683: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-120509: shapedplugin: The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is…4.7 MediumN/AN/ANov 7, 2026
CVE-2026-119183: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 7, 2026
CVE-2026-118066: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to…9.1 CriticalN/AN/ANov 7, 2026
CVE-2026-118056: oxilab: The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is…4.9 MediumN/AN/ANov 7, 2026
CVE-2026-118050: antoineh Football Pool: The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-118047: sbouey Falang multilanguage for WordPress: The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-116751: Amelia Booking for Appointments and Events Calendar – Amelia Pro: The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL…7.5 HighN/AN/ANov 7, 2026
CVE-2026-116537: jackdewey Link Library: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter…7.2 HighN/AN/ANov 7, 2026
CVE-2026-115548: quttera Quttera ThreatSign – Web Malware Scanner for WordPress: The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/AN/ANov 7, 2026
CVE-2026-111370: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 7, 2026
CVE-2026-111317: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/ANov 7, 2026
CVE-2026-109230: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 7, 2026
CVE-2026-109214: wedevs: The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend…7.2 HighN/AN/ANov 7, 2026
CVE-2026-104768: rubengc: The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is…7.5 HighN/AN/ANov 7, 2026
CVE-2026-104760: wedevs: The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-103914: wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-102564: wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor): The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119498: RelyWP Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-109991: teamfunnelkit FunnelKit Payment Gateway for Stripe WooCommerce: The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object…7.5 HighN/AN/ANov 7, 2026
CVE-2026-104014: naimurrahmannahid Naimur Email OTP Verification for WooCommerce: The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in…9.8 CriticalN/AN/ANov 7, 2026
CVE-2026-118267: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…8.1 HighN/AN/ANov 7, 2026
CVE-2026-119075: themegrill Registration Form for WooCommerce: The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing…9.8 CriticalN/AN/ANov 7, 2026
CVE-2026-104746: stylemix Motors – Car Dealership & Classified Listings Plugin: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion…8.1 HighN/AN/ANov 7, 2026
76-100 of 552853
‹›