High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 154 of 556
- 8.1 /10 HighCVE-2026-104899 No auth
GeoDirectory WP Business Directory Plugin - Local File Inclusion
GeoDirectory WP Business Directory Plugin and Classified Listings Directory plugin for WordPress <= 2.8.187 contains a local file inclusion caused by improper sanitization of 'design_type' parameter, letting unauthenticated attackers execute arbitrary PHP code remotely, exploit requires no authentication or user interaction.
- 8.1 /10 HighCVE-2026-104797 No auth
Advanced Form Integration — Connect Forms to 300+ Apps - Authentication Bypass
Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin <= 2.9.0 contains an authentication bypass via unverified password change caused by lack of submitter identity and capability checks in the Ultimate Member Update Profile Field action, letting unauthenticated attackers change any user's password including administrators, exploit requires pre-configured Contact Form 7 integration mapping email, field key, and value.
- 8.8 /10 HighCVE-2026-104766 Auth required
Appointment Booking Plugin – LatePoint - Privilege Escalation
Appointment Booking Plugin – LatePoint for WordPress <= 5.7.3 contains a privilege escalation caused by lack of server-side validation in OsSettingsController::update(), letting authenticated attackers with settings__edit capability escalate privileges by changing default customer role to administrator, exploit requires settings__edit capability granted by admin.
- 8.1 /10 HighCVE-2026-104759
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) - Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 contains an authentication bypass caused by improper nonce validation in Id_Token_Service_Deprecated::process_openidconnect_token(), letting unauthenticated attackers replay valid id_tokens to authenticate as any user, exploit requires use_id_token_parser_v2 plugin option enabled.
- 7.2 /10 HighCVE-2026-104752 Auth required
Rank Math SEO WordPress plugin - Unrestricted File Upload
Rank Math SEO WordPress plugin < 1.0.280 contains an unrestricted file upload vulnerability caused by improper file type validation in the settings import feature, letting administrator users upload PHP files and execute code remotely, exploit requires administrator privileges.
- 8.8 /10 HighCVE-2026-104725 Auth required
Groundhogg CRM - Privilege Escalation
Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.9 contains a privilege escalation caused by missing ownership and capability checks in process_edit() function, letting authenticated users with edit_contacts capability escalate to administrator by linking contacts to admin user IDs and using auto-login URLs, exploit requires authenticated user with sales_rep-level access or higher.
- 8.8 /10 HighCVE-2026-104723 Auth required
LifterLMS WordPress Plugin - Insecure Deserialization
LifterLMS WordPress plugin <= 10.2.1 contains a PHP Object Injection caused by deserialization of untrusted input during lesson creation, letting authenticated users with edit_course capability inject PHP objects, exploit requires specific user roles and presence of a POP chain.
- 7.2 /10 HighCVE-2026-104021 Auth required
Fastcache WordPress Plugin - Code Injection
Fastcache by Host.it WordPress plugin <= 1.7.4 contains a code injection caused by improper sanitization of the cache_cookie_exclude setting, letting authenticated administrators inject arbitrary Apache directives via .htaccess, exploit requires admin privileges.
- 7.5 /10 HighCVE-2026-103071 No auth
VillaTheme Thank You Page Customizer for WooCommerce - Code Injection
VillaTheme Thank You Page Customizer for WooCommerce <= 1.2.3 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-102388 No auth
WPMU DEV Forminator - Stored XSS
WPMU DEV Forminator <= 1.57.3 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.
- 8.4 /10 HighCVE-2026-101947 No auth
ExifTool for photo and video - Command Injection
ExifTool for photo and video 5.0.1-gms by CellHubs contains a command injection caused by improper escaping of embedded single quotes in CSV-export path shell command construction, letting attackers execute arbitrary commands remotely, exploit requires crafted file paths.
- 7.2 /10 HighCVE-2026-101920 No auth
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress - Stored XSS
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin <= 5.2.12 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' href attribute, letting unauthenticated attackers inject arbitrary scripts that execute when users access the page, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-100196 No auth
LazyLoad Plugin - Stored XSS
LazyLoad Plugin for WordPress <= 2.4.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'comment_content', letting unauthenticated attackers inject scripts executed by users, exploit requires admin approval of crafted comment.
- 7.2 /10 HighCVE-2026-100178 No auth
WPAdverts – Classifieds Plugin - Stored XSS
WPAdverts – Classifieds Plugin for WordPress <= 2.3.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'adverts_location' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.
- 7.2 /10 HighCVE-2026-100161 No auth
Photo Reviews for WooCommerce - Stored XSS
Photo Reviews for WooCommerce WordPress plugin <= 1.2.30 contains a stored XSS caused by insufficient sanitization of 'wcpr_image_upload_id' parameter, letting unauthenticated attackers inject scripts executed on review pages, exploit requires no authentication.