The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125767: NerdPress Hubbub Lite: Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125766: WPZOOM WPZOOM Social Feed Widget & Block: Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125763: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125762: LeapWorx Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125746: ProPluginsLab Back In Stock Notifier for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125743: WPVibes Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125708: BdThemes Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125454: WP Chill Passster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125450: Brainstorm Force SureRank: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125448: Kaliforms Kali Forms: Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125446: WisdmLabs Edwiser Bridge: Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-125445: Infomaniak Network VOD Infomaniak: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125436: Mamunur Rashid The Post Grid: Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125435: IdeaBox Creations PowerPack Addons for Elementor: Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125433: FuturioWP Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125431: Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125046: John-Michael L'Allier Create: Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125045: John-Michael L'Allier Create: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124745: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124744: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-124496: Apache Software Foundation Apache Storm: The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation…N/AN/AN/ANov 11, 2026
CVE-2026-124495: Apache Software Foundation Apache Storm: When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as…N/AN/AN/ANov 11, 2026
CVE-2026-124417: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124416: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124411: Brainstorm Force SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 11, 2026
101-125 of 511254