The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-122087: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the…3.7 LowN/AN/ANov 11, 2026
CVE-2026-122061: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121998: Unknown iChart: The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121873: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121870: Unknown Simpler Checkout: The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its…7.5 HighN/AN/ANov 11, 2026
CVE-2026-121863: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them…7.1 HighN/AN/ANov 11, 2026
CVE-2026-121862: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-121472: Unknown AutomatorWP: The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration…5.0 MediumN/AN/ANov 11, 2026
CVE-2026-119531: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-119529: Unknown Gravity Forms: The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users…5.9 MediumN/AN/ANov 11, 2026
CVE-2026-119303: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119035: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-119034: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119033: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post…2.2 LowN/AN/ANov 11, 2026
CVE-2026-119032: Unknown Schema & Structured Data for WP & AMP: The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118439: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side…4.1 MediumN/AN/ANov 11, 2026
CVE-2026-118420: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118241: Unknown Smush: The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media…2.7 LowN/AN/ANov 11, 2026
CVE-2026-118041: Unknown Contest Gallery: The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce…8.8 HighN/AN/ANov 11, 2026
CVE-2026-117524: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status…2.7 LowN/AN/ANov 11, 2026
CVE-2026-117523: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-117522: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-117521: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a…6.8 MediumN/AN/ANov 11, 2026
201-225 of 511254