High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 146 of 556

  • 8.6 /10 High
    CVE-2026-103695 No auth

    Mobile builder WordPress - SQL Injection

    Mobile builder WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL statements, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-103694 Auth required

    Mobile builder WordPress plugin - Broken Access Control

    Mobile builder WordPress plugin through 1.4.2 contains a broken access control vulnerability caused by improper restriction of user meta key updates via REST routes, letting logged-in users escalate privileges to administrator, exploit requires user to be logged in.

  • 8.8 /10 High
    CVE-2026-103305 No auth

    Prenotazioni WordPress - Stored XSS

    Prenotazioni WordPress plugin through 1.7.5 contains a stored cross-site scripting caused by lack of authorization and CSRF checks when saving settings and improper escaping, letting unauthenticated attackers execute scripts against administrators and visitors, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97264 No auth

    Greg Winiarski WPAdverts - Reflected XSS

    Greg Winiarski WPAdverts <= 2.3.4 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-97263 No auth

    Greg Winiarski WPAdverts - Stored XSS

    Greg Winiarski WPAdverts <= 2.3.4 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-96840 No auth

    Post Grid Gutenberg Blocks – PostX - Stored Cross-Site Scripting

    Post Grid Gutenberg Blocks – PostX plugin for WordPress <= 5.1.0 contains a stored cross-site scripting caused by insufficient sanitization of display_name user field, letting unauthenticated attackers inject scripts executed when users access injected pages.

  • 7.2 /10 High
    CVE-2026-96765 No auth

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) - Stored Cross-Site Scripting

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'id_token' parameter, letting unauthenticated attackers inject scripts executed when an admin visits the WPO365 wizard page, exploit requires admin to visit the wizard page.

  • 7.2 /10 High
    CVE-2026-96682 No auth

    Presto Player - Stored Cross-Site Scripting

    Presto Player WordPress plugin <= 4.5.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in <presto-player> tag, letting unauthenticated attackers inject scripts executed by users, exploit requires initial comment approval.

  • 7.2 /10 High
    CVE-2026-96667 No auth

    The Real Estate Manager – Property Listing and Agent Management - Stored XSS

    The Real Estate Manager – Property Listing and Agent Management WordPress plugin <= 7.3 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'first_name' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-96662 No auth

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - SQL Injection

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.7.2 contains a sql injection caused by insufficient escaping of 'booking[service_id]' parameter, letting unauthenticated attackers extract sensitive database information.

  • 7.2 /10 High
    CVE-2026-96572 No auth

    WP Meteor Website Speed Optimization Addon - Stored XSS

    WP Meteor Website Speed Optimization Addon plugin for WordPress <= 3.4.18 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the comment author name, letting unauthenticated attackers inject scripts executed when users access the injected page, exploit requires comment author name to pass WordPress comment moderation.

  • 7.2 /10 High
    CVE-2026-96558 No auth

    Quiz and Survey Master - Stored XSS

    Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress <= 11.2.6 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in 'qsm_hidden_questions' parameter, letting unauthenticated attackers inject arbitrary scripts that execute when users access injected pages, exploit requires triggering audit trail code by forcing mlw_results INSERT failure.

  • 8.2 /10 High
    CVE-2026-96341 No auth

    WPMU DEV Forminator - Privilege Escalation

    WPMU DEV Forminator <= 1.57.3 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

  • 7.2 /10 High
    CVE-2026-96278 No auth

    WP Photo Album Plus - Stored XSS

    WP Photo Album Plus plugin for WordPress <= 9.3.03.002 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in REQUEST_URI Session History, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-95684 No auth

    VikBooking Hotel Booking Engine & PMS - Stored XSS

    VikBooking Hotel Booking Engine & PMS WordPress plugin <= 1.8.15 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'attachments[name]' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.