The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120840: ThemeGrill User Registration: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-120548: icopydoc YML for Yandex Market: The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120532: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-120514: dylanjkotze Zephyr Project Manager: The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-119520: Brainstorm Force Spectra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119511: Saeed MC Woocommerce Wishlist: Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119507: WPDeveloper NotificationX: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119502: BdThemes Ultimate Store Kit Elementor Addons: Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119500: bPlugins Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash &…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119494: Gemini Labs Site Reviews: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119493: Metaphor Creations, LLC Ditty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-119491: David Lingren Media LIbrary Assistant: Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119486: WP ManageNinja LLC FluentBoards: Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119484: Supsystic Photo Gallery by Supsystic: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows…6.3 MediumN/AN/ANov 7, 2026
CVE-2026-119473: properfraction ProfilePress: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-119465: WPVibes Elementor Addon Elements: Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-119164: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2…7.5 HighN/AN/ANov 7, 2026
CVE-2026-119155: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all…7.5 HighN/AN/ANov 7, 2026
CVE-2026-118784: john-dagelmore: The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-110004: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-107616: melograno Booking for Appointments and Events Calendar – Amelia: The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization…7.5 HighN/AN/ANov 7, 2026
CVE-2026-104992: melograno Booking for Appointments and Events Calendar – Amelia: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-103900: denishua WPJAM Basic: The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This…8.1 HighN/AN/ANov 7, 2026
CVE-2026-66669: Suplugins: Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer…8.8 HighN/AN/ANov 7, 2026
CVE-2026-52713: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.4 MediumN/AN/ANov 7, 2026
126-150 of 425038
‹›