The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110454: Ubiquiti Inc UniFi Protect AI Key: A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi…5.3 MediumN/AN/AOct 14, 2026
CVE-2026-106931: EG Secure Solutions Inc.: SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute…7.8 High8.5 HighN/AOct 14, 2026
CVE-2026-105429: NetBird: Improper neutralization of special elements in the NetBird client SSH configuration manager…8.0 High8.9 HighN/AOct 14, 2026
CVE-2026-101926: hyyan Hyyan WooCommerce Polylang Integration: The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids'…6.5 MediumN/AN/AOct 14, 2026
CVE-2026-103369: joaoromao Social Share Buttons & Analytics Plugin – GetSocial.io: The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/AOct 14, 2026
CVE-2026-101924: ice00 NewStatPress: The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…7.2 HighN/AN/AOct 14, 2026
CVE-2026-97471: themefusion Avada (Fusion) Builder: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…5.3 MediumN/AN/AOct 14, 2026
CVE-2026-97398: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis'…7.2 HighN/AN/AOct 14, 2026
CVE-2026-97020: dougwollison PO/MO Editor: The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all…6.4 MediumN/AN/AOct 14, 2026
CVE-2026-96661: pasyuk Gmedia Photo Gallery: The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter…7.5 HighN/AN/AOct 14, 2026
CVE-2026-95816: edgarrojas Smart Forms – when you need more than just a contact form: The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/AN/AOct 14, 2026
CVE-2026-95808: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind…7.5 HighN/AN/AOct 14, 2026
CVE-2026-95807: foliovision FV Player 8: The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in…6.4 MediumN/AN/AOct 14, 2026
CVE-2026-94377: avisverifies Verified Reviews (Avis Vérifiés): The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…7.2 HighN/AN/AOct 14, 2026
CVE-2026-93885: blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations: The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/AN/AOct 14, 2026
CVE-2026-87855: ntbyk JTL-Connector for WooCommerce: The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-83592: doctorwp Contact Form DB for Enfold: The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field…7.2 HighN/AN/AOct 14, 2026
CVE-2026-78193: ntbyk JTL-Connector for WooCommerce: The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push'…7.5 HighN/AN/AOct 14, 2026
CVE-2026-77114: danrossiter Document Gallery: The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action…7.2 HighN/AN/AOct 14, 2026
CVE-2026-16495: wpdevart Countdown Timer – Widget Countdown: The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/AOct 14, 2026
CVE-2026-104800: streetforce1 AGE-GATE: The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via…9.8 CriticalN/AN/AOct 14, 2026
CVE-2026-100193: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site…4.7 MediumN/AN/AOct 14, 2026
CVE-2026-100185: wpwax: The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 14, 2026
CVE-2026-100153: ice00 NewStatPress: The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI'…7.2 HighN/AN/AOct 14, 2026
CVE-2026-110453: NixOS Nix: Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon…4.3 MediumN/AN/AOct 14, 2026
1-25 of 657253
›