The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-103917: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary…6.5 MediumN/A0%Nov 7, 2026
CVE-2026-97191: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when…2.7 LowN/A0%Nov 7, 2026
CVE-2026-97190: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the…2.7 LowN/A0%Nov 7, 2026
CVE-2026-97189: Unknown Advanced Custom Fields (ACF®): The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it…2.7 LowN/A0%Nov 7, 2026
CVE-2026-122001: Unknown Komfortkasse for WooCommerce: The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API…8.8 HighN/A0%Nov 7, 2026
CVE-2026-121866: Unknown iLeads SMS Gateway by Exsile: The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX…8.8 HighN/A0%Nov 7, 2026
CVE-2026-121858: Unknown Event Tickets with Ticket Scanner: The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before…6.3 MediumN/A0%Nov 7, 2026
CVE-2026-121857: Unknown Event Tickets with Ticket Scanner: The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce…4.2 MediumN/A0%Nov 7, 2026
CVE-2026-121848: Unknown Magic Link: The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to…8.8 HighN/A0%Nov 7, 2026
CVE-2026-121796: Unknown Add From Server Lite: The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post…6.8 MediumN/A0%Nov 7, 2026
CVE-2026-121492: Unknown Fiber Admin: The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-121491: Unknown Fiber Admin: The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP…9.0 CriticalN/A0%Nov 7, 2026
CVE-2026-121380: Unknown Tournamatch: The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-121379: Unknown Tournamatch: The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or…9.6 CriticalN/A0%Nov 7, 2026
CVE-2026-119073: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing…6.8 MediumN/A0%Nov 7, 2026
CVE-2026-118534: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-118533: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-118532: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…6.5 MediumN/A0%Nov 7, 2026
CVE-2026-118530: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check…5.0 MediumN/A0%Nov 7, 2026
CVE-2026-118529: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify…3.1 LowN/A0%Nov 7, 2026
CVE-2026-118528: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-117588: Unknown WP Google Review Slider: The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active…4.3 MediumN/A0%Nov 7, 2026
CVE-2026-117525: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded…7.5 HighN/A0%Nov 7, 2026
CVE-2025-15708: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug…3.5 LowN/A0%Nov 7, 2026
CVE-2026-9601: bfintal Stackable – Page Builder Gutenberg Blocks: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/A0%Nov 7, 2026
201-225 of 522604
‹›