The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-123705: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123704: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123703: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123702: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-123701: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123700: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123699: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…4.8 MediumN/AN/ANov 11, 2026
CVE-2026-123698: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123697: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123696: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123695: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API…9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-123667: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-123666: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the…4.9 MediumN/AN/ANov 11, 2026
CVE-2026-123661: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-123657: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123656: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule…N/AN/AN/ANov 11, 2026
CVE-2026-123134: Unknown Smoove abandoned cart trigger for WooCommerce: The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape…8.8 HighN/AN/ANov 11, 2026
CVE-2026-122087: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the…3.7 LowN/AN/ANov 11, 2026
CVE-2026-122061: Unknown Event Tickets and Registration: The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121998: Unknown iChart: The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121873: Unknown Redirection for Contact Form 7: The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121870: Unknown Simpler Checkout: The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its…7.5 HighN/AN/ANov 11, 2026
CVE-2026-121863: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them…7.1 HighN/AN/ANov 11, 2026
CVE-2026-121862: Unknown Knowledge Building: The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply…8.8 HighN/AN/ANov 11, 2026
CVE-2026-121497: Unknown AskAny: The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages,…9.8 CriticalN/AN/ANov 11, 2026
201-225 of 511254