The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-124418: Ahmad WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124267: Noor Alam Gmail SMTP: Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/ANov 13, 2026
CVE-2026-124272: Dimitri Grassi Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi…7.1 HighN/AN/ANov 13, 2026
CVE-2026-121776: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-124260: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/AN/ANov 13, 2026
CVE-2026-124420: Themeisle Woody ad snippets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody…7.1 HighN/AN/ANov 13, 2026
CVE-2026-119512: Tribulant Software Newsletters: Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object…8.8 HighN/AN/ANov 13, 2026
CVE-2026-125783: madalin.ungureanu Custom Post Types and Custom Fields creator – WCK: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu…7.1 HighN/AN/ANov 13, 2026
CVE-2026-120835: VillaTheme AFFI – Affiliate Marketing for WooCommerce: Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce…8.8 HighN/AN/ANov 13, 2026
CVE-2026-124970: WP BASE WP BASE Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE…9.3 CriticalN/AN/ANov 13, 2026
CVE-2026-125851: themagnifico52 Hotel Booking Lite: Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite…9.9 CriticalN/AN/ANov 13, 2026
CVE-2026-125858: CleverReach CleverReach® WP: Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly…6.3 MediumN/AN/ANov 13, 2026
CVE-2026-125856: Sarah Giles Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125854: Unbounce Unbounce Landing Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125855: Elextensions ELEX WordPress HelpDesk & Customer Ticketing System: Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-125837: thethemefoundry Make: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry…7.1 HighN/AN/ANov 13, 2026
CVE-2026-125853: Everestthemes Everest Backup: Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125852: Realtyna Realtyna Organic IDX plugin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna…7.7 HighN/AN/ANov 13, 2026
CVE-2026-103769: Acowebs PDF Invoices and Packing Slips For WooCommerce: Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce…7.2 HighN/AN/ANov 13, 2026
CVE-2026-125452: Denishua WPJAM Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM…7.1 HighN/AN/ANov 13, 2026
CVE-2026-82175: Dell: Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability3.8 LowN/AN/ANov 13, 2026
CVE-2026-107522: Dell: Dell PowerStore contains an Improper Authorization vulnerability7.2 HighN/AN/ANov 13, 2026
CVE-2026-125802: Brainstorm Force Spectra: Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125825: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125794: hupe13 Extension for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension…6.5 MediumN/AN/ANov 13, 2026
76-100 of 532044