The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
WordPress Plugin: wplr-sync: CVE-2026-123666: Missing Authorization4.9 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-user-avatar: CVE-2026-123661: Missing Authorization4.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-user-avatar: CVE-2026-123657: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-user-avatar: CVE-2026-123656: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123134: Unknown Smoove abandoned cart trigger for WooCommerce: The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape…8.8 HighN/AN/ANov 11, 2026
WordPress Plugin: event-tickets: CVE-2026-122087: Missing Authorization3.7 LowN/AN/ANov 11, 2026
WordPress Plugin: event-tickets: CVE-2026-122061: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121998: Unknown iChart: The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX…8.8 HighN/AN/ANov 11, 2026
WordPress Plugin: wpcf7-redirect: CVE-2026-121873: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: simpler-checkout: CVE-2026-121870: Improper Privilege Management7.5 HighN/AN/ANov 11, 2026
WordPress Plugin: knowledge-building: CVE-2026-121863: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.1 HighN/AN/ANov 11, 2026
WordPress Plugin: knowledge-building: CVE-2026-121862: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8.8 HighN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…9.8 CriticalN/AN/ANov 11, 2026
WordPress Plugin: automatorwp: CVE-2026-121472: Cross-Site Request Forgery (CSRF)5.0 MediumN/AN/ANov 11, 2026
WordPress Plugin: live-composer-page-builder: CVE-2026-119531: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.8 MediumN/AN/ANov 11, 2026
CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…5.9 MediumN/AN/ANov 11, 2026
WordPress Plugin: notificationx: CVE-2026-119303: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: schema-and-structured-data-for-wp: CVE-2026-119035: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6.4 MediumN/AN/ANov 11, 2026
WordPress Plugin: schema-and-structured-data-for-wp: CVE-2026-119034: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: schema-and-structured-data-for-wp: CVE-2026-119033: Authorization Bypass Through User-Controlled Key2.2 LowN/AN/ANov 11, 2026
WordPress Plugin: schema-and-structured-data-for-wp: CVE-2026-119032: Missing Authorization5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: limit-login-attempts-reloaded: CVE-2026-118439: Server-Side Request Forgery (SSRF)4.1 MediumN/AN/ANov 11, 2026
WordPress Plugin: wpdirectorykit: CVE-2026-118420: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6.8 MediumN/AN/ANov 11, 2026
WordPress Plugin: wpdirectorykit: CVE-2026-118418: Exposure of Sensitive Information to an Unauthorized Actor5.3 MediumN/AN/ANov 11, 2026
WordPress Plugin: wp-smushit: CVE-2026-118241: Authorization Bypass Through User-Controlled Key2.7 LowN/AN/ANov 11, 2026
1051-1075 of 422975