High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 143 of 556
- 8.6 /10 HighCVE-2026-88930 No auth
Social Web Suite WordPress plugin - SQL Injection
Social Web Suite WordPress plugin through 4.1.12 contains an SQL injection caused by lack of shared secret validation and unsanitized parameter usage in SQL statements, letting unauthenticated users execute arbitrary SQL queries.
- 8.8 /10 HighCVE-2026-88905 No auth
KeyWord Collector WordPress - Stored XSS
KeyWord Collector WordPress plugin through 1.4 contains a stored XSS caused by lack of authorization and nonce checks when saving settings, letting unauthenticated attackers execute malicious JavaScript via admin settings page or frontend output, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-88903 No auth
Topcontent WordPress plugin - Stored XSS
Topcontent WordPress plugin through 1.2.1 contains a stored XSS caused by improper authorization and disabled HTML sanitisation in a request handler, letting unauthenticated attackers publish malicious JavaScript posts, exploit requires no API key configuration.
- 8.8 /10 HighCVE-2026-88827 Auth required
Disable Users WordPress - Broken Access Control
Disable Users WordPress plugin through 1.0.5 contains a broken access control vulnerability caused by incomplete enforcement of account-disabling on all authentication paths, letting disabled users authenticate with full privileges.
- 8.8 /10 HighCVE-2026-88826 No auth
SmugMug Embed WordPress - Stored XSS
SmugMug Embed WordPress plugin through 3.13 contains a stored XSS caused by lack of authorization and CSRF checks on an AJAX action that stores unsanitized gallery data, letting unauthenticated attackers execute scripts when admins view settings.
- 8.8 /10 HighCVE-2026-87764 No auth
BuddyPress Instant Chat - Stored XSS
BuddyPress Instant Chat WordPress plugin <= 1.6 contains a stored XSS caused by lack of sender verification and improper escaping of message content, letting unauthenticated attackers execute scripts in other users' sessions, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-87762 No auth
Adwised Web Push Notification - Stored XSS
Adwised Web Push Notification WordPress plugin through 2.5.7 contains a stored XSS caused by missing authorization checks and bypassable secret comparison when the secret key is unset, letting unauthenticated users execute arbitrary JavaScript in visitors' browsers.
- 8.0 /10 HighCVE-2026-87761 Auth required
Adwised Web Push Notification - Stored XSS
Adwised Web Push Notification WordPress plugin through 2.5.7 contains a stored cross-site scripting caused by lack of capability and nonce checks and unescaped configuration values in inline scripts, letting authenticated users execute scripts on visitors including admins.
- 8.8 /10 HighCVE-2026-87760 No auth
Web Vitals Tracking WordPress - Stored XSS
Web Vitals Tracking WordPress plugin through 5.4.2 contains a stored cross-site scripting caused by lack of validation and escaping of performance measurements submitted by unauthenticated visitors, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-86798 No auth
HootBoard WordPress plugin - Stored XSS
HootBoard WordPress plugin through 3.1.4 contains a stored XSS vulnerability caused by lack of authorization checks and escaping on some REST endpoints, letting unauthenticated attackers execute arbitrary scripts in visitors' browsers.
- 7.2 /10 HighCVE-2026-85126 Auth required
Crowdfundly WordPress plugin - Broken Access Control
Crowdfundly WordPress plugin through 2.2.2 contains a broken access control vulnerability caused by missing capability checks on some AJAX actions, letting low privileged users escalate to administrator role, exploit requires user with low privileged role.
- 8.8 /10 HighCVE-2026-84261 No auth
Click5 CRM - Stored XSS
Click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-84260 No auth
click5 CRM - Stored XSS
click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-84259 No auth
click5 CRM WPForms - Stored XSS
click5 CRM add-on to WPForms WordPress plugin through 1.0.3 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-84258 No auth
click5 CRM Ninja Forms - Stored XSS
click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.