The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-104746: stylemix Motors – Car Dealership & Classified Listings Plugin: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion…8.1 HighN/AN/ANov 7, 2026
CVE-2026-104014: naimurrahmannahid Naimur Email OTP Verification for WooCommerce: The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in…9.8 CriticalN/AN/ANov 7, 2026
CVE-2026-103914: wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-102564: wpvibes Dynific Addons for Elementor (formerly Anywhere Elementor): The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-123961: TOTOLINK CA300-PoE: A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.8849.9 Critical8.6 HighN/ANov 7, 2026
CVE-2026-123470: HivePress: Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-123468: StylemixThemes Motors: Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-123148: TMS IvyForms: Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121783: Passionate Programmer Peter WP Data Access: Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-121724: WebberZone Contextual Related Posts: Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-121571: WP Desk Autopay dla WooCommerce: Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120857: VideoWhisper.com 2Way VideoCalls and Random Chat: Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120837: Everest Forms: Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120365: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-120364: Untapwp Vidplex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119525: WP Desk Dropshipping XML for WooCommerce: Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119523: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119513: Ahmad JS Help Desk: Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119508: Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services: Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119501: BdThemes Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119496: David Lingren Media LIbrary Assistant: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119492: Metaphor Creations, LLC Ditty: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119490: Made with Fuel Ltd. Better Notifications for WP: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119478: StylemixThemes MasterStudy LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-95870: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions…7.5 HighN/A1%Nov 7, 2026
101-125 of 522604
‹›