High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 2 of 552

  • 7.2 /10 High
    CVE-2026-104000 No auth

    Simply Schedule Appointments - Stored XSS

    Simply Schedule Appointments WordPress plugin <= 1.6.12.35 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'status' parameter, letting unauthenticated attackers inject scripts executed by administrators with Support PIN, exploit requires knowledge of site-wide Support PIN.

  • 7.2 /10 High
    CVE-2026-96570 No auth

    Schema & Structured Data for WP & AMP - Stored Cross-Site Scripting

    Schema & Structured Data for WP & AMP WordPress plugin <= 1.67 contains a stored XSS caused by insufficient sanitization and escaping of 'saswp_review_text' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires nonce exposure.

  • 7.2 /10 High
    CVE-2026-109232 No auth

    Salon Booking System – Appointment Booking for Salons, Barbershops & Spas - Stored XSS

    Salon Booking System – Appointment Booking for Salons, Barbershops & Spas WordPress plugin <= 10.31.9 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'sln[<checkout-field-key>]' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires configured custom checkout field of type Html or File.

  • 7.2 /10 High
    CVE-2026-109207 No auth

    RSS Aggregator by Feedzy - Stored XSS

    RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress <= 5.2.11 contains a stored XSS caused by insufficient sanitization of 'media:thumbnail@url' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires attacker-controlled external RSS feed configured for import.

  • 8.1 /10 High
    CVE-2026-97296 No auth

    Rocketgenius Gravity Forms - Insecure Deserialization

    Rocketgenius, Inc Gravity Forms < 3.1.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-95809 No auth

    Opti-Behavior WordPress Plugin - Stored XSS

    Opti-Behavior WordPress plugin <= 1.9.2.1 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping of 'country_name' location parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires nonce obtainable via public AJAX action.

  • 7.2 /10 High
    CVE-2026-95686 No auth

    Opti-Behavior WordPress Plugin - Stored XSS

    Opti-Behavior WordPress plugin <= 1.9.2.1 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'targetUrl' parameter, letting unauthenticated attackers inject scripts executed by users visiting injected pages, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-109513 No auth

    NotificationX WordPress Plugin - Stored XSS

    NotificationX WordPress plugin <= 3.3.3 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'name' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires enabled WordPress.org Reviews campaign and placed dynamic block on public page.

  • 7.5 /10 High
    CVE-2026-107659 No auth

    Modula Image Gallery – Photo Grid & Video Gallery - Sensitive Information Exposure

    Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin <= 3.0.11 contains a sensitive information exposure caused by lack of password redaction in /wp-json/wp/v2/modula-gallery/{id} REST endpoint, letting unauthenticated attackers extract plaintext passwords and usernames from modulaSettings, exploit requires unauthenticated access to REST API.

  • 8.1 /10 High
    CVE-2026-103895 No auth

    miniOrange OTP Login, Verification and SMS Notifications - Authentication Bypass

    miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress <= 5.5.8 contains an authentication bypass caused by improper handling of Delay OTP grace flag in mo_by_pass_login(), letting unauthenticated attackers login as any user including admins, exploit requires OTP-only login and Delay OTP Verification enabled with target account in Delay OTP interval.

  • 7.2 /10 High
    CVE-2026-109998 No auth

    Mang Board WordPress Plugin - Stored XSS

    Mang Board WordPress plugin <= 2.4.3 contains a stored XSS caused by insufficient sanitization and escaping of the 'content' parameter in wp_ajax_nopriv_mb_template endpoint, letting unauthenticated attackers inject scripts executed by users, exploit requires public access to the endpoint without authentication.

  • 7.5 /10 High
    CVE-2026-110590 No auth

    Klarna for WooCommerce - Authorization Bypass

    Klarna for WooCommerce plugin for WordPress <= 4.13.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers access full order PII and secret order keys, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-14177 No auth

    IKAS Technology Inc. Ikas E-Commerce Infrastructure - Authentication Bypass

    IKAS Technology Inc. Ikas E-Commerce Infrastructure through 2026-07-13 contains an account footprinting vulnerability caused by observable response discrepancies, letting attackers gather account information, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-96339 No auth

    Houzez.co Houzez - Reflected XSS

    Houzez.co Houzez <= 4.4.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.

  • 7.2 /10 High
    CVE-2026-109193 No auth

    HivePress Business Directory - Stored XSS

    HivePress Business Directory, Listings & Classified Ads Plugin for WordPress <= 1.7.32 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in custom user attribute slug, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires admin configuration of custom user attribute with display_format placing %value% in href, src, or style context.