The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121778: WP Lab WP-Lister Lite for Amazon: Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121779: YITH YITH WooCommerce Subscription: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123881: OpenBMB Internet of Agents: A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a7.3 High5.5 MediumN/ANov 7, 2026
CVE-2026-93370: paystack Paystack WooCommerce Payment Gateway: The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure in all…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-87112: quarka QA Assistants – Driven by data: The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,…8.8 HighN/AN/ANov 7, 2026
CVE-2026-83495: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in the Trainer v2 TrainJob APIN/AN/AN/ANov 7, 2026
CVE-2026-122265: vanquish83 Vanquish Upload Files for WooCommerce: The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up…5.9 MediumN/AN/ANov 7, 2026
CVE-2026-122037: agenwebsite AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia: The AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia plugin for WordPress is…7.2 HighN/AN/ANov 7, 2026
CVE-2026-121792: rubengc: The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-121536: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120537: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/ANov 7, 2026
CVE-2026-120530: webtoffee WebToffee WP Backup and Migration: The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to generic SQL Injection via the 'description'…5.7 MediumN/AN/ANov 7, 2026
CVE-2026-120515: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO: The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-120479: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-118801: kodezen: The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-118800: kodezen: The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-118204: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-118048: peterschulznl: The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Simple Form autocomplete…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-116621: ultimatemember: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin…6.4 MediumN/AN/ANov 7, 2026
CVE-2026-116558: unitecms Unlimited Elements for Elementor: The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/ANov 7, 2026
CVE-2026-115811: wpchill Strong Testimonials: The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'star_rating'…7.2 HighN/AN/ANov 7, 2026
CVE-2026-103917: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-122001: Unknown Komfortkasse for WooCommerce: The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API…N/AN/AN/ANov 7, 2026
CVE-2026-121866: Unknown iLeads SMS Gateway by Exsile: The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX…N/AN/AN/ANov 7, 2026
CVE-2026-121858: Unknown Event Tickets with Ticket Scanner: The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before…N/AN/AN/ANov 7, 2026
176-200 of 552853
‹›