The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-93293: saadiqbal Password Protected – Protect Your Site Content With a Password: The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-89216: The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL…N/AN/AN/AOct 29, 2026
CVE-2026-88928: The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment…N/AN/AN/AOct 29, 2026
CVE-2026-86794: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public…N/AN/AN/AOct 29, 2026
CVE-2026-85007: The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset…N/AN/AN/AOct 29, 2026
CVE-2026-78396: The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose…N/AN/AN/AOct 29, 2026
CVE-2026-78395: The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when…N/AN/AN/AOct 29, 2026
CVE-2026-19610: Missing Authorization6.5 MediumN/AN/AOct 29, 2026
CVE-2026-15564: Inclusion of Functionality from Untrusted Control Sphere7.4 HighN/AN/AOct 29, 2026
CVE-2026-118905: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions7.0 High7.1 HighN/AOct 29, 2026
CVE-2026-115302: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes…N/AN/AN/AOct 29, 2026
CVE-2026-115301: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its…N/AN/AN/AOct 29, 2026
CVE-2026-115300: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…N/AN/AN/AOct 29, 2026
CVE-2026-115299: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…N/AN/AN/AOct 29, 2026
CVE-2026-115282: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering…N/AN/AN/AOct 29, 2026
CVE-2026-115259: The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks…N/AN/AN/AOct 29, 2026
CVE-2026-115245: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…N/AN/AN/AOct 29, 2026
CVE-2026-114488: A flaw was found in Wildfly7.4 HighN/AN/AOct 29, 2026
CVE-2026-114270: The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…N/AN/AN/AOct 29, 2026
CVE-2026-113617: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…N/AN/AN/AOct 29, 2026
CVE-2026-113616: The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…N/AN/AN/AOct 29, 2026
CVE-2026-111739: The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0…N/AN/AN/AOct 29, 2026
CVE-2026-110983: The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of…N/AN/AN/AOct 29, 2026
CVE-2026-110505: The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG…N/AN/AN/AOct 29, 2026
CVE-2026-110504: The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content…N/AN/AN/AOct 29, 2026
1-25 of 413066
›