The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-92978: wpeverest: The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom…4.3 MediumN/AN/AOct 17, 2026
CVE-2026-92798: wpeverest: The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up…8.1 HighN/AN/AOct 17, 2026
CVE-2026-92715: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…4.3 MediumN/AN/AOct 17, 2026
CVE-2026-111726: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-110268: wpazleen Post Export Import with Media: The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and…4.9 MediumN/AN/AOct 17, 2026
CVE-2026-109989: themifyme Themify Popup: The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit'…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-109985: wpdevteam: The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-109369: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up…6.8 MediumN/AN/AOct 17, 2026
CVE-2026-109368: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all…6.5 MediumN/AN/AOct 17, 2026
CVE-2026-108123: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up…7.5 HighN/AN/AOct 17, 2026
CVE-2026-107752: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON…4.9 MediumN/AN/AOct 17, 2026
CVE-2026-107744: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to…6.5 MediumN/AN/AOct 17, 2026
CVE-2026-104736: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via…9.8 CriticalN/AN/AOct 17, 2026
CVE-2026-103899: daigo75 EU VAT Assistant for WooCommerce: The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 17, 2026
CVE-2026-111602: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to…3.7 LowN/AN/AOct 17, 2026
CVE-2026-111601: hippooo Hippoo Mobile App for WooCommerce: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…6.1 MediumN/AN/AOct 17, 2026
CVE-2026-110653: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to…9.1 CriticalN/AN/AOct 17, 2026
CVE-2026-109208: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 17, 2026
CVE-2026-107763: hostspa Fastcache by Host.it: The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…4.3 MediumN/AN/AOct 17, 2026
CVE-2026-107762: themeum: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct…7.5 HighN/AN/AOct 17, 2026
CVE-2026-104734: themeum: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object…7.2 HighN/AN/AOct 17, 2026
CVE-2026-111855: Tektronix 3 Series MDO: An issue was discovered on Tektronix 3 Series MDO devices before 1.21.17.5 HighN/AN/AOct 17, 2026
CVE-2026-111854: Tektronix 3 Series MDO: An issue was discovered on Tektronix 3 Series MDO devices before 1.21.18.1 HighN/AN/AOct 17, 2026
CVE-2026-111853: Tektronix 3 Series MDO: An issue was discovered on Tektronix 3 Series MDO devices before 1.21.18.8 HighN/AN/AOct 17, 2026
CVE-2026-111823: Mage mage-ai: Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.9.8 CriticalN/AN/AOct 17, 2026
76-100 of 408260
‹›