Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 2 of 677

  • 7.2 /10 High
    CVE-2026-109990 No auth

    The Flying Scripts WordPress - Stored XSS

    The Flying Scripts WordPress plugin <= 1.2.4 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit bypasses WordPress save-time sanitization.

  • 7.2 /10 High
    CVE-2026-109224 No auth

    SureCart WordPress - Stored XSS

    SureCart WordPress plugin <= 4.9.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts that execute when users access affected pages, exploit requires specific shortcode and page conditions.

  • 9.8 /10 Critical
    CVE-2026-104730 No auth

    Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers - Insecure Deserialization

    Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers WordPress plugin <= 3.7.4 contains a PHP Object Injection caused by deserialization of untrusted input, letting unauthenticated attackers inject PHP objects if a POP chain is present in other plugins/themes, exploit requires presence of a POP chain in other installed plugins or themes.

  • 7.2 /10 High
    CVE-2026-111122 No auth

    SiteOrigin CSS WordPress Plugin - Stored XSS

    SiteOrigin CSS WordPress plugin <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient sanitization and escaping of the 'href' parameter, letting unauthenticated attackers inject scripts executed by administrators, exploit requires comment approval and admin interaction.

  • 7.2 /10 High
    CVE-2026-107764 No auth

    SiteOrigin CSS - Stored XSS

    SiteOrigin CSS plugin for WordPress <= 1.6.7 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'url (comment_author_url)' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-104000 No auth

    Simply Schedule Appointments - Stored XSS

    Simply Schedule Appointments WordPress plugin <= 1.6.12.35 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'status' parameter, letting unauthenticated attackers inject scripts executed by administrators with Support PIN, exploit requires knowledge of site-wide Support PIN.

  • 7.2 /10 High
    CVE-2026-96570 No auth

    Schema & Structured Data for WP & AMP - Stored Cross-Site Scripting

    Schema & Structured Data for WP & AMP WordPress plugin <= 1.67 contains a stored XSS caused by insufficient sanitization and escaping of 'saswp_review_text' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires nonce exposure.

  • 7.2 /10 High
    CVE-2026-109232 No auth

    Salon Booking System – Appointment Booking for Salons, Barbershops & Spas - Stored XSS

    Salon Booking System – Appointment Booking for Salons, Barbershops & Spas WordPress plugin <= 10.31.9 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'sln[<checkout-field-key>]' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires configured custom checkout field of type Html or File.

  • 7.2 /10 High
    CVE-2026-109207 No auth

    RSS Aggregator by Feedzy - Stored XSS

    RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress <= 5.2.11 contains a stored XSS caused by insufficient sanitization of 'media:thumbnail@url' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires attacker-controlled external RSS feed configured for import.

  • 8.1 /10 High
    CVE-2026-97296 No auth

    Rocketgenius Gravity Forms - Insecure Deserialization

    Rocketgenius, Inc Gravity Forms < 3.1.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-95809 No auth

    Opti-Behavior WordPress Plugin - Stored XSS

    Opti-Behavior WordPress plugin <= 1.9.2.1 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping of 'country_name' location parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires nonce obtainable via public AJAX action.

  • 7.2 /10 High
    CVE-2026-95686 No auth

    Opti-Behavior WordPress Plugin - Stored XSS

    Opti-Behavior WordPress plugin <= 1.9.2.1 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'targetUrl' parameter, letting unauthenticated attackers inject scripts executed by users visiting injected pages, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-109513 No auth

    NotificationX WordPress Plugin - Stored XSS

    NotificationX WordPress plugin <= 3.3.3 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'name' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires enabled WordPress.org Reviews campaign and placed dynamic block on public page.

  • 9.8 /10 Critical
    CVE-2026-104798 No auth

    My Calendar – Accessible Event Manager - Privilege Escalation

    My Calendar – Accessible Event Manager WordPress plugin <= 3.8.7 contains a privilege escalation caused by unsanitized 'mcs' GET parameter allowing unauthenticated attackers to invoke arbitrary PHP functions, letting attackers gain full admin access, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-107659 No auth

    Modula Image Gallery – Photo Grid & Video Gallery - Sensitive Information Exposure

    Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin <= 3.0.11 contains a sensitive information exposure caused by lack of password redaction in /wp-json/wp/v2/modula-gallery/{id} REST endpoint, letting unauthenticated attackers extract plaintext passwords and usernames from modulaSettings, exploit requires unauthenticated access to REST API.