Статьи Support
🚨 CVE-2026-8444
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type...
🚨 CVE-2026-49772
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.
This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
🚨 CVE-2026-53899
Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
🚨 CVE-2026-28615
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
🚨 CVE-2026-39557
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
🚨 CVE-2026-39558
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
🚨 CVE-2026-39567
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
🚨 CVE-2026-40724
CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.
🚨 CVE-2026-40731
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
🚨 CVE-2026-40735
Unauthenticated PHP Object Injection in Reina <= 2.1 versions.
🚨 CVE-2026-40751
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
🚨 CVE-2026-40753
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
🚨 CVE-2026-40754
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
🚨 CVE-2026-40783
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
🚨 CVE-2026-49080
Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.
🚨 CVE-2026-49081
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
🚨 CVE-2026-54188
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
🚨 CVE-2026-54804
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
🚨 CVE-2026-54805
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.
🚨 CVE-2026-54806
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.