The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-106004: Unknown DT LMS: The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions,…N/AN/AN/ANov 3, 2026
CVE-2026-105993: Unknown DT Directory Lite Addon: The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings…N/AN/AN/ANov 3, 2026
CVE-2026-105967: Unknown Gallery for Social Photo: The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to…N/AN/AN/ANov 3, 2026
CVE-2026-104648: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to…N/AN/AN/ANov 3, 2026
CVE-2026-104647: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission…N/AN/AN/ANov 3, 2026
CVE-2026-103379: Unknown WATI Chat and Notification: The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public…N/AN/AN/ANov 3, 2026
CVE-2026-120971: Red Hat: A flaw was found in RESTEasy's default exception mapper5.3 MediumN/AN/ANov 3, 2026
CVE-2026-77800: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers…7.7 HighN/AN/ANov 3, 2026
CVE-2026-77799: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows…7.4 HighN/AN/ANov 3, 2026
CVE-2026-120578: migkapa AI Alt Text Generator: The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120538: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account…8.1 HighN/AN/ANov 3, 2026
CVE-2026-120577: wpmanageninja: The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary…8.1 HighN/AN/ANov 3, 2026
CVE-2026-120575: tigroumeow Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/ANov 3, 2026
CVE-2026-120574: surecart: The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and…8.1 HighN/AN/ANov 3, 2026
CVE-2026-120534: ACF Extended Advanced Custom Fields: Extended PRO: The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions…9.8 CriticalN/AN/ANov 3, 2026
CVE-2026-120563: amirhelzer WPML Multilingual & Multicurrency for WooCommerce: The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all…4.9 MediumN/AN/ANov 3, 2026
CVE-2026-120561: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120559: satindersingh Contact Form Extender for Divi – Submissions DB & Extra Fields: The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to…7.5 HighN/AN/ANov 3, 2026
CVE-2026-120524: blazethemes News Kit Addons For Elementor: The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData'…6.4 MediumN/AN/ANov 3, 2026
CVE-2026-120558: zorem Advanced Shipment Tracking for WooCommerce: The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the…7.2 HighN/AN/ANov 3, 2026
CVE-2026-120552: tigroumeow: The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/ANov 3, 2026
CVE-2026-120551: aresit WP Compress – Instant Performance & Speed Optimization: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120544: kodezen: The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-120518: kalengi BuddyPress XProfile Custom Image Field: The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up…9.1 CriticalN/AN/ANov 3, 2026
CVE-2026-111464: emrevona WP Fastest Cache – WordPress Cache Plugin: The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…5.9 MediumN/AN/ANov 3, 2026
76-100 of 528356
‹›