The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-115262: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its…4.8 MediumN/AN/ANov 4, 2026
CVE-2026-115257: Unknown WP Roster: The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-115250: Unknown Text Typing: The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-115243: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file…6.7 MediumN/AN/ANov 4, 2026
CVE-2026-115242: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination…5.5 MediumN/AN/ANov 4, 2026
CVE-2026-115241: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot…6.5 MediumN/AN/ANov 4, 2026
CVE-2026-114431: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-112244: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-112243: Unknown: The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape…5.8 MediumN/AN/ANov 4, 2026
CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…3.7 LowN/AN/ANov 4, 2026
CVE-2026-111740: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before…2.7 LowN/AN/ANov 4, 2026
CVE-2026-110964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the…6.5 MediumN/AN/ANov 4, 2026
CVE-2026-110692: Unknown: The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate…4.1 MediumN/AN/ANov 4, 2026
CVE-2026-108068: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one…3.8 LowN/AN/ANov 4, 2026
CVE-2026-108067: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before…3.8 LowN/AN/ANov 4, 2026
CVE-2026-108041: Unknown SEOPress: The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before…7.1 HighN/AN/ANov 4, 2026
CVE-2026-106649: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with…6.8 MediumN/AN/ANov 4, 2026
CVE-2026-106000: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-105413: Unknown Form Maker by 10Web: The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before…7.5 HighN/AN/ANov 4, 2026
CVE-2026-105191: Unknown: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a…4.3 MediumN/AN/ANov 4, 2026
CVE-2026-104719: Unknown CookieYes: The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script…6.4 MediumN/AN/ANov 4, 2026
CVE-2026-101166: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before…3.7 LowN/AN/ANov 4, 2026
CVE-2026-101165: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the…3.7 LowN/AN/ANov 4, 2026
CVE-2025-11229: WSO2: The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled7.2 HighN/AN/ANov 4, 2026
CVE-2026-87044: zephyrproject zephyr: The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations6.5 MediumN/AN/ANov 4, 2026
151-175 of 537178
‹›