{"vulnerability": "cve-2026-9450", "sightings": [{"uuid": "79c08078-3122-4a57-99a7-2356a8a728f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94501", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2ivod5ko2b", "content": "\ud83d\udfe0 CVE-2026-94501 - High (8.8)\n\njshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-94501/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-21T20:01:31.733432Z"}, {"uuid": "d5ee0b6c-fc86-4ac0-b71e-a9d110b5fd3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bv3gfivokqwwm", "content": "CVE-2026-94504 - Ninja Forms \u2013 The Contact Form Builder That Grows With You\nCVE ID : CVE-2026-94504\n \n Published : Sept. 22, 2026, 6:39 a.m. | 39\u00a0minutes ago\n \n Description : Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encodin...", "creation_timestamp": "2026-09-22T07:44:46.508949Z"}, {"uuid": "11f7151e-e36b-4059-b575-11da51aaa948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94501", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw5wvr4ske2o", "content": "CVE-2026-94501 - jsherp\nIn jshERP versions up to 3.6, a logged\u2011in user can use the system\u2019s create, edit and delete functions to modify the role assignments of any account without proper checks. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jsherp #jishenghua #CVE #infosec", "creation_timestamp": "2026-09-23T04:50:05.052999Z"}, {"uuid": "a3f51bdc-ca1a-492a-be4d-3a9b4628d37c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://t.me/GithubRedTeam/103183", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-94504\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:37:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNinja Forms unauth stored XSS POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T02:00:12.000000Z"}, {"uuid": "8b2c9e70-1a2d-4e8f-8aa7-15ef02748378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103183", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-94504\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:37:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNinja Forms unauth stored XSS POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-24T02:00:12.000000Z"}, {"uuid": "86755cbe-a830-43be-94f2-d729322734fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "content": "", "creation_timestamp": "2026-09-24T09:00:04.000000Z"}, {"uuid": "8d2968b4-573a-4fd2-9673-0164e2e87bdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "published-proof-of-concept", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "content": "", "creation_timestamp": "2026-09-24T09:00:04.000000Z"}, {"uuid": "f6b3fc8a-57b9-48ef-b01e-e2d23814b6ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwlle6zoxd2g", "content": "CVE-2026-94504: Ninja Forms 3.15.3 stored XSS, CVSS 7.2. Attacker script runs in WordPress admin origin. No patch yet - restrict submission access and watch vendor advisories. https://www.valtersit.com/cve/CVE-2026-94504/ #CVE #infosec #WordPress", "creation_timestamp": "2026-09-28T15:00:41.680507Z"}, {"uuid": "be83fce5-dd03-4b02-b170-4ac7ab6785a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117349299413510599", "content": "CVE-2026-94504: Ninja Forms 3.15.3 stored XSS, CVSS 7.2. Attacker script runs in WordPress admin origin. No patch yet - restrict submission access and watch vendor advisories. https://www.valtersit.com/cve/CVE-2026-94504/ #CVE #infosec #WordPress", "creation_timestamp": "2026-09-28T15:10:21.700819Z"}, {"uuid": "0ca56e1f-bc85-4b76-a098-f447f04d1c57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94505", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7rdlc772r6ip5", "content": "CVE-2026-94505 - Nelio Content\nCVE ID : CVE-2026-94505\n \n Published : Oct. 3, 2026, 6:38 a.m. | 45\u00a0minutes ago\n \n Description : The Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up ...", "creation_timestamp": "2026-10-03T07:59:19.342745Z"}, {"uuid": "91d3d79a-b0a1-4452-8f1c-ce00551b1962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94505", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwy6pi5iqa2e", "content": "\ud83d\udfe0 CVE-2026-94505 - High (8.1)\n\nThe Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vuln...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-94505/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-03T15:18:58.204017Z"}, {"uuid": "d3115eef-84a6-47b9-8e66-45a7e0a0924d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxado4nqut2j", "content": "\ud83e\udd16 Actively exploited: stored XSS in WordPress plugins Ninja Forms (CVE-2026-93836) and WPC Product Bundles (CVE-2026-94504) \u2192 backdoors + rogue admin accounts. Patch now.\nhttps://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/", "creation_timestamp": "2026-10-06T21:08:59.766322Z"}, {"uuid": "b38ea5f9-11ef-47a8-8b8d-c9c8d30136c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxbf5qulxz2j", "content": "Ninja Forms CVE-2026-94504 and WPC Product Bundles CVE-2026-93836 stored XSS are exploited to plant hidden WordPress admins. Update to 3.15.4 / 8.6.7, then audit: the update does not clean an infection. https://cti.securitycyber.uk", "creation_timestamp": "2026-10-07T07:08:16.480793Z"}, {"uuid": "65f3c48b-7db8-4ade-9ed5-f1c12ba2f567", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94504", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mxc4jwlws62s", "content": "\ud83d\udcf0 Celah Ninja Forms dan WPC Product Bundles Dieksploitasi untuk Bobol Situs WordPress\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/07/ninja-forms-wordpress-cve-2026-94504-exploit/\n\n#cybersecurity #keamananSiber #malware #vulnerability #woocommerce #wordpress", "creation_timestamp": "2026-10-07T14:06:42.730071Z"}, {"uuid": "5881fcdd-d1cd-41cb-ba02-787d15c75c5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "exploited", "source": "https://t.me/true_secator/8686", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 WordPress, Ninja Forms \u0438 WPC Product Bundles for WooCommerce \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041e\u0431\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0438 \u0442\u0440\u0435\u0431\u0443\u044e\u0442 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0435\u0441\u0441\u0438\u0438. CVE-2026-93836 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442\u044b \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 WPC \u0434\u043b\u044f WooCommerce \u0432\u0435\u0440\u0441\u0438\u0439 8.6.6 \u0438 \u0441\u0442\u0430\u0440\u0448\u0435, \u0430 CVE-2026-94504 - Ninja Forms \u0432\u0435\u0440\u0441\u0438\u0439 3.15.3 \u0438 \u0441\u0442\u0430\u0440\u0448\u0435.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c Ninja Forms \u0434\u043b\u044f WordPress \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043d\u0430 500 000 \u0441\u0430\u0439\u0442\u0430\u0445 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0444\u043e\u0440\u043c\u044b \u0431\u0435\u0437 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, WPC Product Bundles for WooCommerce - \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0442\u044c \u0442\u043e\u0432\u0430\u0440\u044b \u0432 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0442\u044b \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043d\u0430 30 000 \u0441\u0430\u0439\u0442\u0430\u0445 WordPress.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 Patchstack \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 WPC Product Bundles \u0434\u043b\u044f WooCommerce. \u041d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 Ninja Forms.\n\n\u0412 \u043e\u0431\u0435\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 JavaScript-\u043a\u043e\u0434 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0441\u044f \u0441 \u0441\u0430\u0439\u0442\u0430 imgcdn1[.]com, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0437\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0431\u043e\u0438\u0445 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0441\u0442\u043e\u0438\u0442 \u0442\u043e\u0442 \u0436\u0435 \u0430\u043a\u0442\u043e\u0440.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 JavaScript (x.js) \u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u043e\u0432 WooCommerce \u0438\u043b\u0438 \u0432 \u0444\u043e\u0440\u043c\u044b Ninja Forms. \u041a\u043e\u0433\u0434\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u043a\u043e\u043d\u0442\u0435\u043d\u0442, \u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 WordPress.\n\n\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043e\u043d \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 nonce-\u043a\u043e\u0434\u044b \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WordPress \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u0430, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u043f\u043e\u0434 WP Smart Thumbnails \u0432\u0435\u0440\u0441\u0438\u0438 1.2.4 \u043e\u0442 MediaPress Labs, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 JavaScript-\u043a\u043e\u0434 \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u0430\u0439\u0442\u0443, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0432\u0438\u0434\u0438\u043c\u044b\u0439 \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u043e\u0442 \u0441\u043f\u0438\u0441\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 WordPress \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0439 URL-\u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u044f\u043c\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c\u0443 PHP-\u0444\u0430\u0439\u043b\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u0430.\n\n\u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043d\u043e \u0435\u0433\u043e \u0432\u0441\u0435 \u0440\u0430\u0432\u043d\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u0441\u0430\u0439\u0442.\n\n\u0414\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u043b\u0430\u0433\u0438\u043d WP Smart Thumbnails \u0431\u0443\u0434\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d \u0441 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430, \u0441\u043a\u0440\u044b\u0442\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0439 URL \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0430\u043a \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0430\u0442\u0430\u043a\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0442\u043a\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f.\n\nPatchstack \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u044b, \u043d\u043e \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439: WPC Product Bundles for WooCommerce \u0432\u0435\u0440\u0441\u0438\u0438 8.6.7 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0438 Ninja Forms 3.15.4 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 IOCs.", "creation_timestamp": "2026-10-07T10:20:18.000000Z"}, {"uuid": "7e9336ee-ad32-4226-ad35-c56bb0ae4b32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxda5ql55r2y", "content": "An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.\n\n#WordPress #NinjaForms #WooCommerce #CVE202694504 #CVE202693836 #XSS #ExploitedInTheWild #Malware", "creation_timestamp": "2026-10-08T00:44:07.235295Z"}, {"uuid": "508814f0-5ae1-48f9-9cd9-0961bcd36b5e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94504", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e1ec1166-19d6-4883-92e2-0fdf6d18c1e3", "content": "", "creation_timestamp": "2026-10-08T08:00:31.966621Z"}]}