A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, can be exploited to allow subscriber-level users access to arbitrary files on the server.

An authenticated attacker could use it to access sensitive files, such as wp-config.php, which includes database credentials, keys, and salt data, creating the risk for user data theft and complete website takeover.

Smart Slider 3 is one of the most popular WordPress plugins for creating and managing image sliders and content carousels. It offers an easy-to-use drag-and-drop editor and a rich set of templates to choose from.

The security issue, tracked as CVE-2026-3098, was discovered and reported by researcher Dmitrii Ignatyev and impacts all versions of the Smart Slider 3 plugin through 3.5.1.33.

It received a medium severity score due to requiring authentication. However, this only limits the impact to websites with membership or subscription options, a feature that is common on many platforms these days.

The vulnerability stems from missing capability checks in the plugin’s AJAX export actions. This allows any authenticated user, including subscribers, to invoke them.

According to researchers at WordPress security company Defiant, the developer of the Wordfence security plugin, the ‘actionExportAll’ function lacks file type and source validation, thus allowing arbitrary server files to be read and added to the export archive.

The presence of a nonce does not prevent abuse because it can be obtained by authenticated users.

“Unfortunately, this function does not include any file type or file source checks in the vulnerable version. This means that not only image or video files can be exported, but .php files can as well,” says István Márton, a vulnerability research contractor at Defiant.

“This ultimately makes it possible for authenticated attackers with minimal access, like subscribers, to read any arbitrary file on the server, including the site’s wp-config.php file, which contains the database credentials as well as keys and salts for cryptographic security.”

500K websites still vulnerable

On February 23, Ignatyev reported his findings to Wordfence, whose researchers validated the provided proof-of-concept exploit and informed Nextendweb, the developer of Smart Slider 3.

Nextendweb acknowledged the report on March 2 and on March 24 delivered a patch with the release of Smart Slider version 3.5.1.34.

According to WordPress.org stats, the plugin was downloaded 303,428 times over the past week. This means that at least 500,000 WordPress sites are running a vulnerable version of the Smart Slider 3 plugin and are exposed to attacks.

CVE-2026-3098 is not flagged as actively exploited as of writing, but the status may change soon, so prompt action is required by website owners/administrations.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now

JBL is doubling down on portable party speakers with a clear focus on karaoke, expanding its PartyBox lineup with the new PartyBox On-The-Go 2 Plus alongside the EasySing microphone ecosystem. At the center of the launch is AI-powered EasySing technology, which uses on-device processing to separate vocals from music in real time—allowing users to reduce or remove the original singer without relying on cloud services or pre-processed tracks.

The system goes beyond simple vocal stripping. JBL integrates pitch support, Voice Boost for high-frequency clarity, and built-in effects like reverb, echo, and noise suppression to create a more controlled and customizable performance. Paired with the new EasySing microphones, the platform is designed to turn any song into an instant karaoke track while keeping latency low and setup straightforward—no apps, subscriptions, or external processing required.

“As music continues to evolve, so does the way people experience it together,” said Carsten Olesen, President of Consumer Audio at HARMAN. “At JBL, we’re harnessing advanced AI technologies like real-time vocal separation and intelligent vocal enhancement to transform passive listening into shared, interactive moments. By integrating AI directly into our products, we’re creating new ways for people to connect and celebrate.”

JBL PartyBox On-the-Go 2 Plus

Designed to elevate both parties and karaoke nights, the JBL PartyBox On-The-Go 2 Plus combines JBL’s signature sound and dynamic lightshow with its new EasySing AI technology. Using the JBL One app, users can adjust sound and lighting settings, while the system brings vocals forward in real time to instantly transform any track into a performance-ready experience.

Portability gets a practical upgrade with a redesigned central handle for better weight balance, along with a wider, thicker shoulder strap that makes it easier to carry between locations.

Under the hood, the speaker delivers up to 100 watts of power, driven by dual silk-dome tweeters and a 5.25-inch woofer for solid bass and clear, detailed highs. Battery life is rated at up to 15 hours, and the inclusion of a replaceable battery means it’s built for extended sessions without cutting the party short.

For even more party flexibility, the PartyBox On-The-Go 2 Plus is also Auracast compatible for easy multi-speaker pairing with JBL Auracast-enabled speakers

Comparison

JBL EasySing Mics & JBL EasySing Mic Mini

Pro Tip: Images and full specifications for the JBL EasySing Mic Mini were not available at the time of publication.

Expanding the EasySing ecosystem, JBL is also introducing the EasySing Mics and the EasySing Mic Mini. These AI-powered microphones integrate real-time vocal separation and enhancement into a compact, performance-ready design.

Built for flexibility, they offer users greater control over vocals with improved clarity and processing, making them a natural extension of the PartyBox experience for karaoke sessions, parties, and casual performances.

The JBL EasySing Mics provide real-time, AI-powered vocal removal from any track while maintaining clear, balanced audio. Users can adjust the level of original vocals to 25%, 50%, or fully removed, while JBL’s EasySing algorithm enhances live vocals with Voice Boost for improved high-frequency clarity, along with natural reverb, echo, and noise suppression.

The JBL EasySing Mic Mini takes a more compact approach, offering a pocket-sized solution for singing and content creation. It includes Voice Boost for high-pitch support and AI-based noise suppression to reduce background interference, making it suitable for a wider range of environments.

Setup is intentionally simple. There are no apps or complicated pairing steps—just plug the included USB-C dongle into a compatible JBL speaker and start using the microphones immediately. It’s a straightforward, wireless approach that keeps the focus on performance rather than setup.

Portability is also a priority. A compact carrying bag makes it easy to store in a pocket or small bag, while the microphone design includes a ring handle for a secure grip and a magnetic clip for hands-free use.

Each set includes two microphones, offering up to 10 hours of battery life on average and a 30-meter wireless range for duets and group performances. A USB-C dongle is also provided for seamless plug-and-play. EQ customization is provided by the JBL One App

JBL EasySing Mics are compatible with JBL PartyBox On-the-Go 2, JBL PartyBox Encore 2, JBL PartyBox Encore Essential 2, JBL PartyBox Club 120, JBL PartyBox Stage 320, JBL PartyBox 520, and JBL PartyBox 720. 

JBL EasySing Mic Mini is compatible with JBL Go 5, JBL Grip, JBL Flip 7, JBL Charge 6, JBL Xtreme 5, JBL Boombox 4, and all JBL PartyBox models through Aux. (Aux cable not included.)

JBL EasySing Mic Specifications

The Bottom Line 

JBL knows exactly where this category is heading and isn’t standing still. The PartyBox On-The-Go 2 Plus leans hard into AI-driven karaoke with EasySing, combining real-time vocal removal, onboard vocal processing, and Auracast support into a portable speaker that’s built as much for participation as it is for playback. That’s the hook—this isn’t just background music anymore, it’s the main event. The addition of dedicated EasySing microphones pushes JBL further into a more complete ecosystem that feels purpose-built for social listening and performance.

What’s missing? This isn’t an audiophile product and doesn’t pretend to be. You won’t find high-resolution streaming features, advanced codec support, or the kind of system integration that serious hi-fi buyers expect. And if you don’t care about karaoke or AI vocal tricks, the standard PartyBox On-The-Go 2 might make more sense—and cost less—since it sticks to the basics with a traditional wireless mic.

Who is this for? Anyone who wants to turn a backyard, beach day, or living room into a low-effort karaoke setup without messing around with apps, subscriptions, or complicated gear. If your idea of a good night involves a microphone, questionable song choices, and zero patience for setup, JBL just made your life easier.

Price & Availability

• JBL PartyBox On-The-Go 2 Plus comes with one EasySing Mic and is available for pre-sale for $419.95 on JBL.com with a sale date of April 12, 2026.
• JBL PartyBox On-The-Go 2 (without EasySing Mic and AI) – $419 at Amazon
• JBL EasySing Mics – $199 at Amazon
• JBL EasySing Mic Mini will be available for pre-sale beginning April 12, 2026, at JBL.com for $179.95 with an on-sale date of May 10, 2026.

Related Reading:

[Tommy] at Oskitone has been making hardware synth kits for years, and his designs are always worth checking out. His newest offering Space Dice is an educational kit that is a combination vintage sci-fi space laser sound generator, and six-sided die roller. What’s more, as a kit it represents an effort to be genuinely educational, rather than just using it as a meaningless marketing term.

There are several elements we find pretty interesting in Space Dice. One is the fact that, like most of [Tommy]’s designs, there isn’t a microcontroller in sight. Synthesizers based mostly on CMOS logic chips have been a mainstay of DIY electronics for years, as have “electronic dice” circuits. This device mashes both together in an accessible way that uses a minimum of components.

There are only three chips inside: a CD4093 quad NAND with Schmitt-trigger inputs used as a relaxation oscillator, a CD4040 binary counter used as a prescaler, and a CD4017 decade counter responsible for spinning a signal around six LEDs while sound is generated, to represent an electronic die. Sound emerges from a speaker on the backside of the PCB, which we’re delighted to see is driven not by a separate amplifier chip, but by unused gates on the CD4093 acting as a simple but effective square wave booster.

In addition, [Tommy] puts effort into minimizing part count and complexity, ensuring that physical assembly does not depend on separate fasteners or adhesives. We also like the way he uses a lever assembly to make the big activation button — mounted squarely above the 9 V battery — interface with a button on the PCB that is physically off to the side. The result is an enclosure that is compact and tidy.

We recommend checking out [Tommy]’s concise writeup on the design details of Space Dice for some great design insights, and take a look at the assembly guide to see for yourself the attention paid to making the process an educational one. We love the concept of presenting an evolving schematic diagram, which changes and fills out as each assembly step is performed and tested.

Watch it in action in a demo video, embedded just below. Space Dice is available for purchase but if you prefer to roll your own, all the design files and documentation are available online from the project’s GitHub repository.

Until the fall of the Soviet Union around 1990 you’d be forgiven as a proud Soviet citizen for thinking that the USSR’s technology was on par with the decadent West. After the Iron Curtain lifted it became however quite clear how outdated especially consumer electronics were in the USSR, with technologies like digital audio CDs and their players being one good point of comparison. In a recent video by a railways/retro tech YouTube channel we get a look at one of the earliest Soviet CD players.

A good overall summary of how CD technology slowly developed in the Soviet Union despite limitations can be found in this 2025 article by [Artur Netsvetaev]. Soviet technology was characterized mostly by glossy announcements and promises of ‘imminent’ serial production prior to a slow fading into obscurity. Soviet engineers had come up with the Luch-001 digital audio player in 1979, using glass discs. More prototypes followed, but with no means for mass-production and Soviet bureaucracy getting in the way, these efforts died during the 1980s.

During the 1980s CD players were produced in Soviet Estonia in small batches, using Philips internals to create the Estonia LP-010. Eventually sanctions on the USSR would strangle these efforts, however. Thus it wouldn’t be until 1991 that the Vega PKD-122 would become the first mass-produced CD player, with one example featured in this video.

The video helpfully includes a teardown of the player after a rundown of its controls and playback demonstration, so that we can ogle its internals. This system uses mostly localized components, with imported components like the VF display and processors gradually getting replaced over time.  The DAC and optical-mechanical assembly would still be imported from Japan until 1995 when the factory went bankrupt.

This difference between the imported and localized part is captured succinctly in the video with the comparison to Berlin in 1999, in that you can clearly see the difference between East and West. The CD mechanism is produced by Sanyo, with a Sanyo DAC IC on the mainboard. The power supply, display and logic board (using Soviet TTL ICs) are all Soviet-produced. A sticker inside the case identifies this unit as having been produced in 1994.

Amusingly, the front buttons are directly coupled into the mainboard without ESD protection, which means that in a Siberian winter with practically zero relative humidity inside you’d often fry the mainboard by merely using these buttons.

After this exploration the video goes on to explain how Soviet CD production began in the 1989, using imported technology and know-how. This factory was set up in Moscow, using outdated West-German CD pressing equipment and makes for a whole fascinating topic by itself.

Finally, the video explores the CD player’s manual and how to program the player, as well as how to obtain your own Soviet CD player. Interestingly, a former employee of the old factory has taken over the warehouse and set up a web shop selling new old stock as well as repaired units and replacement parts.

Two new models of Meta Ray-Ban AI glasses are on the way, and they’re going to be catered towards those who use prescription lenses, according to a Bloomberg report. While these are supposed to be announced next week, Bloomberg noted that these won’t be a “new generation” of Meta’s smart glasses.

You can already add prescription lenses to Meta Ray-Ban’s AI glasses, but the upcoming models will come in rectangular and rounded styles and will be sold through traditional prescription eyewear channels. Bloomberg didn’t specify how these new glasses will differ from existing options, but noted that it’s the first time Meta and Ray-Ban are releasing a pair of AI glasses specifically designed for this demographic.

The two models are likely the codenamed products Scriber and Blazer, which were first spotted by The Verge in filings with the Federal Communications Commission. The filings described the devices as production units, meaning Meta could be close to the actual product launch. Looking at the filings, it’s unlikely these upcoming prescription AI glasses will have a display like the Meta Ray-Ban Displays.

Meta CEO Mark Zuckerberg has hinted at AI glasses that are meant for prescription glasses wearers in a previous earnings call. As noted by Bloomberg, Zuckerberg previously said that “billions of people wear glasses or contacts for vision correction,” adding that, “it’s hard to imagine a world in several years where most glasses that people wear aren’t AI glasses.”