The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-96570: magazine3 Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/A0%Oct 16, 2026
CVE-2026-95809: optiuser: The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-95686: optiuser: The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-93767: Tainacan: The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via…6.5 MediumN/A1%Oct 16, 2026
CVE-2026-89079: jfarthing84 Theme My Login: The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to,…9.8 CriticalN/A0%Oct 16, 2026
CVE-2026-89051: johndarrel Hide My WP Ghost – Security & Firewall: The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/A0%Oct 16, 2026
CVE-2026-88963: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site…6.1 MediumN/A0%Oct 16, 2026
CVE-2026-85659: ontraport PilotPress: The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to,…8.8 HighN/A0%Oct 16, 2026
CVE-2026-12272: daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent: The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive…5.3 MediumN/A0%Oct 16, 2026
CVE-2026-111458: adulau ssldump: The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509…N/A6.8 Medium0%Oct 16, 2026
CVE-2026-111122: gpriday SiteOrigin CSS: The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter…7.2 HighN/A0%Oct 16, 2026
CVE-2026-110017: fullworks Quick PayPal Payments: Payment Button & Form: The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-109513: wpdevteam: The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner &…7.2 HighN/A0%Oct 16, 2026
CVE-2026-109447: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…8.1 HighN/A0%Oct 16, 2026
CVE-2026-109414: appsbd Vitepos – Point of Sale (POS) for WooCommerce: The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-109232: wordpresschef: The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107764: gpriday SiteOrigin CSS: The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url…7.2 HighN/A0%Oct 16, 2026
CVE-2026-107748: cozmoslabs: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-104932: johnny5 Search Regex: The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of…8.0 HighN/A0%Oct 16, 2026
CVE-2026-104001: rilwis: The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-104000: croixhaug Simply Schedule Appointments: The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status'…7.2 HighN/A0%Oct 16, 2026
CVE-2026-103999: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload…7.2 HighN/A0%Oct 16, 2026
CVE-2026-103896: 10web: The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a…7.5 HighN/A0%Oct 16, 2026
CVE-2026-103768: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in…9.8 CriticalN/A1%Oct 16, 2026
CVE-2026-103480: themefic: The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored…6.4 MediumN/A0%Oct 16, 2026
1001-1025 of 406803
‹›