High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
This feed covers the vulnerability. Panop covers your exposure to it.
How Panop validates exposureCVE monitoring
- The CVE, its CVSS score and the vendor's fix
- Whether CISA has seen it exploited in the wild
- Whether exploit code is public
Panop, in your environment
- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first
High CVEs
Newest first · severity as published by the vendor or NVD · page 1 of 552
- 7.2 /10 HighCVE-2026-97640 No auth
WPConsent - Stored Cross-Site Scripting
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress <= 1.1.9 contains a stored XSS caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed on user page access, exploit requires Script Blocking feature enabled and coordinated comment submission.
- 7.2 /10 HighCVE-2026-89051 No auth
WP Ghost Security & Firewall - Stored XSS
WP Ghost (Hide My WP Ghost) Security & Firewall plugin for WordPress <= 7.0.12 contains a stored XSS caused by insufficient input sanitization and output escaping in replaceHeadersAndTags function, letting unauthenticated attackers execute arbitrary scripts when users click injected links.
- 8.1 /10 HighCVE-2026-104745 PoC publicNo auth
WooCommerce Customer Email Verification - Authentication Bypass
WooCommerce Customer Email Verification plugin <= 3.3.0 contains a privilege escalation caused by weak activation secret generation and unauthenticated verification handler, letting unauthenticated attackers gain authentication as any unverified user, exploit requires 'Encoding method' set to 'hashids' and brute-forcing the activation code.
- 8.6 /10 HighCVE-2026-111446 No auth
Wheels - Broken Access Control
Wheels 4.0.0 through 4.1.2 contains an information disclosure and data tampering vulnerability caused by exposed password-less development tools under /wheels/* with enablePublicComponent=true, letting remote attackers access sensitive application settings and run tests that can modify the primary datasource, exploit requires enablePublicComponent to be enabled.
- 8.1 /10 HighCVE-2026-75903 No auth
Vulnity Security WordPress plugin - Authentication Bypass
Vulnity Security WordPress plugin <= 1.4.3 contains an authentication bypass caused by insufficient protection of delegated-login credential file on Nginx, letting unauthenticated attackers forge REST API requests and log in as admin.
- 7.5 /10 HighCVE-2026-92766 No auth
Vitepos – Point of Sale (POS) for WooCommerce - SQL Injection
Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress <= 3.5.1 contains a SQL injection caused by insufficient escaping of the 'src_by' parameter in /vitepos/v1/vendor/list REST route, letting unauthenticated or POS role attackers extract sensitive database information, exploit requires POS role assignment or no authentication.
- 7.2 /10 HighCVE-2026-87111 No auth
User Registration PRO WordPress Plugin - Stored XSS
User Registration PRO WordPress plugin <= 6.2.9 contains a stored cross-site scripting caused by insufficient input sanitization of the HTTP Referer header, letting unauthenticated attackers inject scripts executed when users access the page, exploit requires access to the vulnerable AJAX endpoint nonce.
- 7.2 /10 HighCVE-2026-100186 No auth
User Profile Builder WordPress Plugin - Stored XSS
User Profile Builder WordPress plugin <= 4.0.3 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the First Name field, letting unauthenticated attackers execute arbitrary scripts when Email Confirmation is enabled.
- 8.1 /10 HighCVE-2026-109447 No auth
User Profile Builder WordPress Plugin - Privilege Escalation
User Profile Builder WordPress plugin <= 4.0.3 contains a privilege escalation caused by lack of allow-list validation on the 'role' parameter in wppb_add_meta_to_user_on_activation(), letting unauthenticated attackers gain administrator privileges via the public registration form, exploit requires legacy 'role' form field, email confirmation, and open user registration.
- 7.2 /10 HighCVE-2026-103999 No auth
Ultra Addons for Contact Form 7 - Stored XSS
Ultra Addons for Contact Form 7 WordPress plugin <= 3.5.54 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in file upload, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires uploading crafted text files bypassing extension blocklist.
- 7.2 /10 HighCVE-2026-107768 No auth
TranslatePress WordPress Plugin - Stored XSS
TranslatePress WordPress plugin <= 3.3.7 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'comment' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires unmoderated comments and secondary language configured.
- 7.2 /10 HighCVE-2026-109990 No auth
The Flying Scripts WordPress - Stored XSS
The Flying Scripts WordPress plugin <= 1.2.4 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit bypasses WordPress save-time sanitization.
- 7.2 /10 HighCVE-2026-109224 No auth
SureCart WordPress - Stored XSS
SureCart WordPress plugin <= 4.9.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts that execute when users access affected pages, exploit requires specific shortcode and page conditions.
- 7.2 /10 HighCVE-2026-111122 No auth
SiteOrigin CSS WordPress Plugin - Stored XSS
SiteOrigin CSS WordPress plugin <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient sanitization and escaping of the 'href' parameter, letting unauthenticated attackers inject scripts executed by administrators, exploit requires comment approval and admin interaction.
- 7.2 /10 HighCVE-2026-107764 No auth
SiteOrigin CSS - Stored XSS
SiteOrigin CSS plugin for WordPress <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'url (comment_author_url)' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.