Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Smart Slider 3 security patch (CVE-2026-3098)

Security Patch Release
First reported
Last updated
Happening score
H score 22
1 unique sources, 1 articles

Summary

Hide ▲

Nextendweb released Smart Slider version 3.5.1.34 on March 24, 2026, closing CVE-2026-3098 in the Smart Slider 3 WordPress plugin. The patch fixes an arbitrary file-read flaw that let authenticated subscriber-level users access sensitive server files, including wp-config.php. That exposure can reveal database credentials, keys, and salts, raising the risk of user data theft and complete website takeover. The vulnerable range covered versions through 3.5.1.33, affecting more than 800,000 websites with at least 500,000 still exposed.

Related Happenings

Avada Builder 3.15.3 patch release (CVE-2026-4782, CVE-2026-4798)

Security Patch Release
First: 15.05.2026 18:56 Last: 15.05.2026 18:56 Sources 1

About this happening: **Avada Builder** shipped **version 3.15.3** as the full fix for **CVE-2026-4782** and **CVE-2026-4798**, closing the plugin flaws that could expose files and database data. A pri...

Open Happening

Google security patch release for CVE-2026-5858

Security Patch Release
First: 10.04.2026 13:44 Last: 10.04.2026 13:44 Sources 1

About this happening: **Google** released the first stable **Chrome 147** build, closing **60 vulnerabilities** and raising the browser’s baseline security ahead of broader deployment. The patch bundle...

Open Happening

Smart Slider 3 Pro update system for WordPress hit by network compromise

Incident
First: 09.04.2026 19:15 Last: 09.04.2026 19:15 Sources 1

About this happening: The **Smart Slider 3 Pro** update system was compromised, and a **malicious 3.5.1.35** release was pushed to **WordPress and Joomla** sites. The bad update could create **hidden a...

Open Happening

Chrome emergency zero-day patch (CVE-2026-3909, CVE-2026-3910)

Security Patch Release
First: 13.03.2026 08:56 Last: 13.03.2026 08:56 Sources 1

About this happening: **Google** pushed an **emergency Chrome update** for **Stable Desktop users** on **Windows, macOS, and Linux** after confirming **CVE-2026-3909** and **CVE-2026-3910** are **explo...

Latest development: 13.03.2026 11:17

Google discovers and reports CVE-2026-3909, an out-of-bounds write vulnerability in the Skia 2D graphics library, and CVE-2026-3910, an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine, on March 10, 2026; both issues are reachable via crafted HTML pages.

Open Happening

Elementor Ally 4.1.0 security patch release (CVE-2026-2313)

Security Patch Release
First: 11.03.2026 21:38 Last: 11.03.2026 21:38 Sources 1

About this happening: **Elementor** released **Ally 4.1.0** to fix **CVE-2026-2313**, a **SQL injection** flaw in the WordPress accessibility plugin that could expose **sensitive data**. The update lan...

Open Happening

Timeline

  1. 29.03.2026 17:38 1 articles · 1mo ago

    CVE-2026-3098 reported to Wordfence

    Initial Disclosure

    Researcher Dmitrii Ignatyev reports CVE-2026-3098 in Smart Slider 3 to Wordfence after validating that authenticated subscriber-level users can abuse AJAX export actions to read arbitrary server files, including wp-config.php, on versions through 3.5.1.33.

    Show sources
    Open in new tab
  3. 29.03.2026 17:38 2 articles · 1mo ago

    Smart Slider version 3.5.1.34 patch released

    Mitigation Patch Update

    Nextendweb releases Smart Slider version 3.5.1.34, addressing CVE-2026-3098 in Smart Slider 3 after the vulnerable range through 3.5.1.33 is identified.

    Show sources
    Open in new tab
  4. 29.03.2026 17:38 1 articles · 1mo ago

    Large Smart Slider 3 exposure remains

    Victim Impact Update

    More than 800,000 websites run Smart Slider 3, and at least 500,000 WordPress sites are still exposed by vulnerable versions through 3.5.1.33, leaving authenticated subscriber-level users able to read arbitrary server files such as wp-config.php on unpatched installations.

    Show sources
    Open in new tab