High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 233 of 568
- 7.1 /10 HighCVE-2026-103354 No auth
Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks - Stored XSS
Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks <= 3.7.11.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-103344 No auth
Unlimited Elements Unlimited Elements For Elementor - Reflected XSS
Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-103062 No auth
Cozmoslabs TranslatePress - Stored XSS
Cozmoslabs TranslatePress <= 3.3.6 contains a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted input submission.
- 7.2 /10 HighCVE-2026-97660 No auth
WPC Product Options for WooCommerce - Stored XSS
WPC Product Options for WooCommerce <= 4.0.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in wpcpo-* array key via multipart field name, letting unauthenticated attackers inject scripts executed on user page access, exploit requires guest checkout.
- 8.8 /10 HighCVE-2026-97644 Auth required
Groundhogg CRM - Privilege Escalation
Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.9 contains a privilege escalation caused by contact identity rebinding via the create_contact function in the v3 REST endpoint, letting authenticated attackers with Sales Representative-level access rebind contacts to arbitrary user IDs and gain administrator access, exploit requires attacker to have Sales Representative-level access.
- 7.2 /10 HighCVE-2026-97341 No auth
Visitor Traffic Real Time Statistics WordPress Plugin - Stored XSS
Visitor Traffic Real Time Statistics WordPress plugin <= 8.16 contains a stored DOM-based cross-site scripting caused by insufficient sanitization of 'X-Real-IP' HTTP header in wp_ajax_nopriv_ahcfree_track_visitor endpoint, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication or special capabilities.
- 7.5 /10 HighCVE-2026-97337 No auth
Simple Membership WordPress Plugin - Broken Access Control
Simple Membership WordPress plugin <= 4.8.3 contains an unauthorized data modification and information disclosure vulnerability caused by lack of authentication and validation in resend-activation and email-activation endpoints, letting unauthenticated attackers redirect activation emails and activate accounts without consent.
- 7.2 /10 HighCVE-2026-96650 No auth
Strong Testimonials WordPress plugin - Stored XSS
Strong Testimonials WordPress plugin <= 3.3.11 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'platform_user_photo' custom field, letting unauthenticated attackers inject scripts executed by users, exploit requires admin to add specific custom fields.
- 7.2 /10 HighCVE-2026-96575 No auth
Transliterator – Multilingual and Multi-script Text Conversion - Stored XSS
Transliterator – Multilingual and Multi-script Text Conversion WordPress plugin <= 2.5.8 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via predictable {rstr_keep} placeholder, letting unauthenticated attackers inject scripts executed on page access, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-96564 No auth
SEOPress AI SEO Plugin - Stored XSS
SEOPress AI SEO Plugin for WordPress <= 10.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Author Display Name, letting unauthenticated attackers execute arbitrary scripts, exploit requires 'Track Authors' custom dimension configured and ability to publish public singular content.
- 8.8 /10 HighCVE-2026-96451 PoC publicAuth required
Ultimate Member - Authorization Bypass
Ultimate Member <= 2.13.1 contains an authorization bypass through user-controlled key, letting attackers escalate privileges, exploit requires crafted user input.
- 7.2 /10 HighCVE-2026-96270 No auth
Ultimate Member - Stored XSS
Ultimate Member WordPress plugin <= 2.13.1 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'form_id' parameter, letting unauthenticated attackers inject scripts executed when admins view user records, exploit requires admin to open affected user record.
- 7.5 /10 HighCVE-2026-96267 No auth
WP Visitor Statistics (Real Time Traffic) - SQL Injection
WP Visitor Statistics (Real Time Traffic) for WordPress <= 8.7 contains a second-order SQL injection caused by insufficient escaping of the 'fullRef' parameter in wmcTrack tracking endpoint, letting unauthenticated attackers extract sensitive database information when an administrator views the Traffic Sources dashboard.
- 8.1 /10 HighCVE-2026-94505 Auth required
Nelio Content – Editorial Calendar & Social Media Auto-Posting - Authorization Bypass
Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress <= 4.5.0 contains an authorization bypass caused by improper user authorization verification, letting authenticated contributors delete reusable social messages, exploit requires contributor-level access.
- 7.2 /10 HighCVE-2026-93889 No auth
Mail logging – WP Mail Catcher - Stored XSS
Mail logging – WP Mail Catcher plugin for WordPress <= 2.1.12 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in PHPMailer 'wp_mail_failed' error message, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires a separately installed plugin passing user input to mail fields.