The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-105152: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125046: John-Michael L'Allier Create: Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125746: ProPluginsLab Back In Stock Notifier for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125767: NerdPress Hubbub Lite: Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125766: WPZOOM WPZOOM Social Feed Widget & Block: Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125448: Kaliforms Kali Forms: Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123481: WP Extended The Ultimate WordPress Toolkit – WP Extended: Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125763: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125436: Mamunur Rashid The Post Grid: Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124416: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125778: myCred: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125431: Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124261: Magepeople inc. Taxi Booking Manager for WooCommerce: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125776: Cozmoslabs Profile Builder: Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126627: Apache Software Foundation Apache XML Graphics FOP: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
CVE-2026-125784: Magnigenie RestroPress: Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-125781: NOUS Ouvert Utile et Simple Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125777: Cozmoslabs Profile Builder: Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125761: YITH YITH WooCommerce Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125680: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125455: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125451: bPlugins B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125444: King Addons King Addons for Elementor: Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125439: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125438: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
76-100 of 511254