---
title: "high"
description: "Swiss autonomous exposure management. Panop discovers internet-facing, cloud and internal assets, offensively tests what is exploitable, and ranks what to fix."
url: https://panop.io/threat-heartbeat/severity/high/
---

# High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

[Book a demo](https://panop.io/demo) [Request a scan](https://panop.io/trial)

Feed at a glance

Tracked

10143

Critical

1867

CISA KEV

79

Public PoC

365

Most common types

- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

## This feed covers the vulnerability. Panop covers your exposure to it.

[How Panop validates exposure](https://panop.io/product/)

CVE monitoring

- The CVE, its CVSS score and the vendor's fix
- Whether CISA has seen it exploited in the wild
- Whether exploit code is public

Panop, in your environment

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

## High CVEs

Newest first · severity as published by the vendor or NVD · page 1 of 552

- 7.2 /10 High 16 Oct 2026

    CVE-2026-97640 No auth

    ## [WPConsent - Stored Cross-Site Scripting](https://panop.io/threat-heartbeat/CVE-2026-97640/)

    WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress <= 1.1.9 contains a stored XSS caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed on user page access, exploit requires Script Blocking feature enabled and coordinated comment submission.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-89051 No auth

    ## [WP Ghost Security & Firewall - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-89051/)

    WP Ghost (Hide My WP Ghost) Security & Firewall plugin for WordPress <= 7.0.12 contains a stored XSS caused by insufficient input sanitization and output escaping in replaceHeadersAndTags function, letting unauthenticated attackers execute arbitrary scripts when users click injected links.

- 8.1 /10 High 16 Oct 2026

    CVE-2026-104745 PoC publicNo auth

    ## [WooCommerce Customer Email Verification - Authentication Bypass](https://panop.io/threat-heartbeat/CVE-2026-104745/)

    WooCommerce Customer Email Verification plugin <= 3.3.0 contains a privilege escalation caused by weak activation secret generation and unauthenticated verification handler, letting unauthenticated attackers gain authentication as any unverified user, exploit requires 'Encoding method' set to 'hashids' and brute-forcing the activation code.

- 8.6 /10 High 16 Oct 2026

    CVE-2026-111446 No auth

    ## [Wheels - Broken Access Control](https://panop.io/threat-heartbeat/CVE-2026-111446/)

    Wheels 4.0.0 through 4.1.2 contains an information disclosure and data tampering vulnerability caused by exposed password-less development tools under /wheels/\* with enablePublicComponent=true, letting remote attackers access sensitive application settings and run tests that can modify the primary datasource, exploit requires enablePublicComponent to be enabled.

- 8.1 /10 High 16 Oct 2026

    CVE-2026-75903 No auth

    ## [Vulnity Security WordPress plugin - Authentication Bypass](https://panop.io/threat-heartbeat/CVE-2026-75903/)

    Vulnity Security WordPress plugin <= 1.4.3 contains an authentication bypass caused by insufficient protection of delegated-login credential file on Nginx, letting unauthenticated attackers forge REST API requests and log in as admin.

- 7.5 /10 High 16 Oct 2026

    CVE-2026-92766 No auth

    ## [Vitepos – Point of Sale (POS) for WooCommerce - SQL Injection](https://panop.io/threat-heartbeat/CVE-2026-92766/)

    Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress <= 3.5.1 contains a SQL injection caused by insufficient escaping of the 'src\_by' parameter in /vitepos/v1/vendor/list REST route, letting unauthenticated or POS role attackers extract sensitive database information, exploit requires POS role assignment or no authentication.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-87111 No auth

    ## [User Registration PRO WordPress Plugin - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-87111/)

    User Registration PRO WordPress plugin <= 6.2.9 contains a stored cross-site scripting caused by insufficient input sanitization of the HTTP Referer header, letting unauthenticated attackers inject scripts executed when users access the page, exploit requires access to the vulnerable AJAX endpoint nonce.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-100186 No auth

    ## [User Profile Builder WordPress Plugin - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-100186/)

    User Profile Builder WordPress plugin <= 4.0.3 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the First Name field, letting unauthenticated attackers execute arbitrary scripts when Email Confirmation is enabled.

- 8.1 /10 High 16 Oct 2026

    CVE-2026-109447 No auth

    ## [User Profile Builder WordPress Plugin - Privilege Escalation](https://panop.io/threat-heartbeat/CVE-2026-109447/)

    User Profile Builder WordPress plugin <= 4.0.3 contains a privilege escalation caused by lack of allow-list validation on the 'role' parameter in wppb\_add\_meta\_to\_user\_on\_activation(), letting unauthenticated attackers gain administrator privileges via the public registration form, exploit requires legacy 'role' form field, email confirmation, and open user registration.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-103999 No auth

    ## [Ultra Addons for Contact Form 7 - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-103999/)

    Ultra Addons for Contact Form 7 WordPress plugin <= 3.5.54 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in file upload, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires uploading crafted text files bypassing extension blocklist.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-107768 No auth

    ## [TranslatePress WordPress Plugin - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-107768/)

    TranslatePress WordPress plugin <= 3.3.7 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'comment' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires unmoderated comments and secondary language configured.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-109990 No auth

    ## [The Flying Scripts WordPress - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-109990/)

    The Flying Scripts WordPress plugin <= 1.2.4 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit bypasses WordPress save-time sanitization.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-109224 No auth

    ## [SureCart WordPress - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-109224/)

    SureCart WordPress plugin <= 4.9.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts that execute when users access affected pages, exploit requires specific shortcode and page conditions.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-111122 No auth

    ## [SiteOrigin CSS WordPress Plugin - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-111122/)

    SiteOrigin CSS WordPress plugin <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient sanitization and escaping of the 'href' parameter, letting unauthenticated attackers inject scripts executed by administrators, exploit requires comment approval and admin interaction.

- 7.2 /10 High 16 Oct 2026

    CVE-2026-107764 No auth

    ## [SiteOrigin CSS - Stored XSS](https://panop.io/threat-heartbeat/CVE-2026-107764/)

    SiteOrigin CSS plugin for WordPress <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'url (comment\_author\_url)' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.