CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro: неаутентифицированная загрузка файла с RCE Расширенные отзывы → saveattachments → Пользовательские шрифты: обход strpos → shell.woff2.php Обзор CVE-2026-58480 также известный как CVE-2026-15158 — это критическая CVSS 9.8 уязвимость неаутентифицированной...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

PT-2026-73133

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.1.2 Description This issue involves a Directory Traversal flaw where authenticated attackers with editor-level access or higher can read arbitrary files on the...