The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-96870: brainstormforce: The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/AN/AOct 16, 2026
CVE-2026-100108: maxfoundry Social Share Buttons: The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing…6.4 MediumN/AN/AOct 16, 2026
CVE-2026-100106: damian-gora FiboSearch – Ajax Search for WooCommerce: The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 16, 2026
CVE-2026-75903: manuelgalan Vulnity Security: The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…8.1 HighN/AN/AOct 16, 2026
CVE-2026-87111: WPEverest: The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for…7.2 HighN/AN/AOct 16, 2026
CVE-2026-97640: smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice): The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)…7.2 HighN/AN/AOct 16, 2026
CVE-2026-97296: Rocketgenius, Inc Gravity Forms: Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object…8.1 HighN/AN/AOct 16, 2026
CVE-2026-96339: Houzez.co Houzez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez…7.1 HighN/AN/AOct 16, 2026
CVE-2026-94388: halfdata Green Popups: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green…9.3 CriticalN/AN/AOct 16, 2026
CVE-2026-94169: Theme-one The Grid: Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command…10.0 CriticalN/AN/AOct 16, 2026
CVE-2026-92553: yaycommerce: The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File…8.8 HighN/AN/AOct 16, 2026
CVE-2026-92427: Unknown Coinsnap Bitcoin Crowdfunding: The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to…N/AN/AN/AOct 16, 2026
CVE-2026-92115: opajaap WP Photo Album Plus: The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to,…8.8 HighN/AN/AOct 16, 2026
CVE-2026-91833: Unknown WX Subscribe 微信支付付费订阅: The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a…N/AN/AN/AOct 16, 2026
CVE-2026-91830: Unknown Subscribe to Comments: The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a…N/AN/AN/AOct 16, 2026
CVE-2026-74923: Unknown Document Gallery: The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating…N/AN/AN/AOct 16, 2026
CVE-2026-19867: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-19798: tusharimran: The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-19603: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-19601: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the…4.9 MediumN/AN/AOct 16, 2026
CVE-2026-19541: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-18795: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM…6.4 MediumN/AN/AOct 16, 2026
CVE-2026-18551: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-15222: wpeverest: The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile,…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-111178: murgroland WP Booking System – Booking Calendar: The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the…4.9 MediumN/AN/AOct 16, 2026
1-25 of 758711
›