The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…5.4 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-54871: Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons: Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-54853: Cozmoslabs Profile Builder: Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-54852: miniOrange Page Restriction WordPress (WP): Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-52708: weDevs WP User Frontend: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-48884: weDevs WP User Frontend: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-42691: EventPrime: Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-39742: Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-39737: Crocoblock JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-27063: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-27062: WPFunnels Team WPFunnels: Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-25450: ThemeGrill User Registration: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-25448: weDevs WP ERP: Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-118097: bPlugins Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash &…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118095: David Lingren Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118092: StylemixThemes MasterStudy LMS: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-118091: WPFunnels Team WPFunnels: Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-118088: WPFunnels Team WPFunnels: Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116856: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116850: weDevs Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-116849: bPlugins StreamCast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-116846: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116406: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-116387: Brainstorm Force SureForms: Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 29, 2026
201-225 of 538495