| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-103367 | ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter | wpdesk | ShopMagic – email automation for WordPress | High | 8.1 | 2026-10-14 07:43:33 | Deep Dive |
| CVE-2026-110284 | LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes | lifterlms | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | High | 7.5 | 2026-10-14 07:43:33 | Deep Dive |
| CVE-2025-9373 | PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | peprodev | PeproDev Branches Map (Mapify) | Medium | 6.4 | 2026-10-14 07:43:33 | Deep Dive |
| CVE-2026-103366 | Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters | latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High | 7.5 | 2026-10-14 07:43:32 | Deep Dive |
| CVE-2026-103380 | Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion | latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium | 4.3 | 2026-10-14 07:43:32 | Deep Dive |
| CVE-2026-100163 | Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback | latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High | 7.4 | 2026-10-14 07:43:32 | Deep Dive |
| CVE-2026-107754 | GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title | paoltaia | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | Medium | 6.4 | 2026-10-14 07:43:31 | Deep Dive |
| CVE-2026-105107 | Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters | Koha Community | Koha | High | 7.6 | 2026-10-14 07:32:57 | Deep Dive |
| CVE-2026-105106 | Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task | Koha Community | Koha | High | 8.8 | 2026-10-14 07:23:03 | Deep Dive |
| CVE-2026-110227 | WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability | 10up | Restricted Site Access | Medium | 5.3 | 2026-10-14 07:11:42 | Deep Dive |
| CVE-2026-109901 | WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability | Codepeople | CP Multi View Event Calendar | High | 8.5 | 2026-10-14 07:11:16 | Deep Dive |
| CVE-2026-107171 | CVE-2026-107171 | Trellix | Trellix Agent | Medium | 6.9 | 2026-10-14 07:11:09 | Deep Dive |
| CVE-2026-89310 | SQL Command Injection Vulnerability in JTL-WMS | JTL SW GmbH | JTL-WMS | Critical | 9.9 | 2026-10-14 06:50:34 | Deep Dive |
| CVE-2026-110467 | WisdomGarden｜Tronclass - Insecure Direct Object Reference | WisdomGarden | Tronclass | Medium | 4.3 | 2026-10-14 06:31:25 | Deep Dive |
| CVE-2026-110466 | WisdomGarden｜Tronclass - Sensitive Data Exposure | WisdomGarden | Tronclass | Medium | 4.3 | 2026-10-14 06:29:53 | Deep Dive |
| CVE-2026-110465 | WisdomGarden｜Tronclass - Insecure Direct Object Reference | WisdomGarden | Tronclass | Medium | 4.3 | 2026-10-14 06:28:22 | Deep Dive |
| CVE-2026-94261 | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id | Unknown | Sifalo Pay | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-94260 | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure | Unknown | Sifalo Pay | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-94254 | SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter | Unknown | SellKit | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-94360 | Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks | Unknown | Paymentfor Gateway for WooCommerce | - | - | 2026-10-14 06:00:16 | Deep Dive |