The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-121873: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address…N/AN/AN/ANov 11, 2026
CVE-2026-121870: Unknown Simpler Checkout: The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its…N/AN/AN/ANov 11, 2026
CVE-2026-121863: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them…N/AN/AN/ANov 11, 2026
CVE-2026-121862: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply…N/AN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…N/AN/AN/ANov 11, 2026
CVE-2026-121472: Unknown AutomatorWP: The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration…N/AN/AN/ANov 11, 2026
CVE-2026-119531: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder…N/AN/AN/ANov 11, 2026
CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…N/AN/AN/ANov 11, 2026
CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…N/AN/AN/ANov 11, 2026
CVE-2026-119035: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data…N/AN/AN/ANov 11, 2026
CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…N/AN/AN/ANov 11, 2026
CVE-2026-119033: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post…N/AN/AN/ANov 11, 2026
CVE-2026-119032: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit…N/AN/AN/ANov 11, 2026
CVE-2026-118439: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side…N/AN/AN/ANov 11, 2026
CVE-2026-118420: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL…N/AN/AN/ANov 11, 2026
CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…N/AN/AN/ANov 11, 2026
CVE-2026-118241: Unknown Smush: The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media…N/AN/AN/ANov 11, 2026
CVE-2026-118041: Unknown Contest Gallery: The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce…N/AN/AN/ANov 11, 2026
CVE-2026-117524: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status…N/AN/AN/ANov 11, 2026
CVE-2026-117523: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a…N/AN/AN/ANov 11, 2026
CVE-2026-117522: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post…N/AN/AN/ANov 11, 2026
CVE-2026-117521: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a…N/AN/AN/ANov 11, 2026
CVE-2026-116081: Fenrir Inc.: Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc4.2 Medium2.3 LowN/ANov 11, 2026
CVE-2026-115735: Unknown Somatic Framework: The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a…N/AN/AN/ANov 11, 2026
CVE-2026-115734: Unknown Pay with a tweet: The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it…N/AN/AN/ANov 11, 2026
76-100 of 511254