The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-110533: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-110305: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all…7.5 HighN/AN/AOct 30, 2026
CVE-2026-110001: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-109984: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-109592: wordpressdotorg: The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce: The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to…7.5 HighN/AN/AOct 30, 2026
CVE-2026-105894: akbilisim Ak Framework: The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to…8.8 HighN/AN/AOct 30, 2026
CVE-2026-104744: Independent Analytics Independent Analytics Pro: The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign'…7.2 HighN/AN/AOct 30, 2026
CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…4.9 MediumN/AN/AOct 30, 2026
CVE-2026-102918: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-102905: spacetime Ad Inserter – Ad Manager & AdSense Ads: The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in…6.5 MediumN/AN/AOct 30, 2026
CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…8.7 HighN/AN/AOct 30, 2026
CVE-2026-62056: WP ManageNinja LLC Fluent CRM: Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62023: Unlimited Elements: Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons,…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-62019: Liquid Web / StellarWP BookIt: Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-104674: Arraytics Booktics: Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-62047: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-39739: Brainstorm Force Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-73322: Apache Software Foundation Apache Pinot: Incorrect Authorization vulnerability in the single-stage query engine of Apache PinotN/AN/AN/AOct 30, 2026
CVE-2026-52710: ithemelandco GIFTiT – Free Gifts for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62057: Fahim Reza Divi Contact Form 7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62121: Unlimited Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62122: Arraytics Booktics: Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119117: AWS amazon-kinesis-producer: Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119979: Element Labs LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that…8.8 High8.7 HighN/AOct 30, 2026
76-100 of 418318