The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-116409: WP Swings Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell…7.1 HighN/AN/AOct 29, 2026
CVE-2026-112827: VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce: Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce…7.1 HighN/AN/AOct 29, 2026
CVE-2026-114193: Eyal Fitoussi GEO my WordPress: Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115599: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115965: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…8.5 HighN/AN/AOct 29, 2026
CVE-2026-115967: Hamid Alinia Login with phone number: Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication…8.8 HighN/AN/AOct 29, 2026
CVE-2026-115963: VideoWhisper.com Broadcast Live Video: Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration…7.1 HighN/AN/AOct 29, 2026
CVE-2026-118989: WebToffee Product Import Export for WooCommerce: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability…5.5 Medium5.1 MediumN/AOct 29, 2026
CVE-2026-33924: Nozomi Networks: Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient…7.2 High7.5 HighN/AOct 29, 2026
CVE-2026-33923: Nozomi Networks: A signature verification vulnerability was discovered in the update installation functionality due to inconsistent…7.2 High7.5 HighN/AOct 29, 2026
CVE-2026-118984: cheaper-inference OmniRoute: OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or…5.5 Medium7.0 HighN/AOct 29, 2026
CVE-2026-91153: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-91152: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…6.1 MediumN/AN/AOct 29, 2026
CVE-2026-118192: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-117611: Checkmk GmbH Checkmk: Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority…N/A7.1 HighN/AOct 29, 2026
CVE-2026-116763: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-111318: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder: The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-110707: themeisle: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress…4.7 MediumN/AN/AOct 29, 2026
CVE-2026-109215: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content'…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-107743: mapster Mapster WP Maps: The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…7.2 HighN/AN/AOct 29, 2026
CVE-2026-107629: wpsoul Greenshift – animation and page builder blocks: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-107627: wpsoul Greenshift – animation and page builder blocks: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-104727: berocket Sequential Order Numbers for WooCommerce: The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-103875: dglingren Media Library Assistant: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…4.7 MediumN/AN/AOct 29, 2026
CVE-2026-103485: hupe13 Extensions for Leaflet Map: The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the…5.4 MediumN/AN/AOct 29, 2026
76-100 of 538495