The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-97314: Unknown ThirstyAffiliates: The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its…N/AN/AN/AOct 17, 2026
CVE-2026-81344: Unknown ACF Frontend Admin by DynamiApps: The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be…N/AN/AN/AOct 17, 2026
CVE-2026-81343: Unknown ACF Frontend Admin by DynamiApps: The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its…N/AN/AN/AOct 17, 2026
CVE-2026-110527: Unknown WP User Manager: The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during…N/AN/AN/AOct 17, 2026
CVE-2026-106470: Unknown WP Data Access: The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions,…N/AN/AN/AOct 17, 2026
CVE-2026-103376: Unknown: The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)…N/AN/AN/AOct 17, 2026
CVE-2026-104122: Unknown Ukr-To-Lat: The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query,…N/AN/AN/AOct 17, 2026
CVE-2026-92432: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting,…N/AN/AN/AOct 17, 2026
CVE-2026-92431: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality,…N/AN/AN/AOct 17, 2026
CVE-2026-92433: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account,…N/AN/AN/AOct 17, 2026
CVE-2026-104246: Unknown Contact Form 7 Signature Addon: The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before…N/AN/AN/AOct 17, 2026
CVE-2026-91074: Unknown BSK PDF Manager: The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in…N/AN/AN/AOct 17, 2026
CVE-2026-96660: wpeverest: The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom…7.2 HighN/AN/AOct 17, 2026
CVE-2026-92978: wpeverest: The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom…4.3 MediumN/AN/AOct 17, 2026
CVE-2026-92798: wpeverest: The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up…8.1 HighN/AN/AOct 17, 2026
CVE-2026-92715: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…4.3 MediumN/AN/AOct 17, 2026
CVE-2026-111726: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-110268: wpazleen Post Export Import with Media: The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and…4.9 MediumN/AN/AOct 17, 2026
CVE-2026-109989: themifyme Themify Popup: The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit'…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-109985: wpdevteam: The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 17, 2026
CVE-2026-109369: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up…6.8 MediumN/AN/AOct 17, 2026
CVE-2026-109368: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all…6.5 MediumN/AN/AOct 17, 2026
CVE-2026-108123: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up…7.5 HighN/AN/AOct 17, 2026
CVE-2026-107752: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON…4.9 MediumN/AN/AOct 17, 2026
CVE-2026-107744: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to…6.5 MediumN/AN/AOct 17, 2026
1-25 of 412906
›