9.8
Critical
CVE-2026-6443 All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions
Description
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Accordion and Accordion Slider | 1.4.6 | No fix stated |
| Portfolio and Projects | 1.5.6 | No fix stated |
| Featured Post Creative | 1.5.7 | No fix stated |
| Post grid and filter ultimate | 1.7.4 | No fix stated |
| WP Featured Content and Slider | 1.7.6 | No fix stated |
| Post Ticker Ultimate | 1.7.6 | No fix stated |
| Trending/Popular Post Slider and Widget | 1.8.6 | No fix stated |
| Meta Slider and Carousel with Lightbox | 2.0.8 | No fix stated |
| Album and Image Gallery Plus Lightbox | 2.1.8 | No fix stated |
Show the 13 other branches Hide the 13 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Timeline and History slider | 2.4.5 | No fix stated |
| WP Blog and Widgets | 2.6.6 | No fix stated |
| Countdown Timer Ultimate | 2.6.9 | No fix stated |
| Blog Designer – Post and Widget | 2.7.7 | No fix stated |
| Team Slider and Team Grid Showcase plus Team Carousel | 2.8.6 | No fix stated |
| Video gallery and Player | 2.8.7 | No fix stated |
| Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions | 2.9.1 | No fix stated |
| Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget | 3.5.6 | No fix stated |
| WP Responsive Recent Post Slider/Carousel | 3.7.1 | No fix stated |
| WP Slick Slider and Image Carousel | 3.7.8.1 | No fix stated |
| WP Logo Showcase Responsive Slider and Carousel | 3.8.7 | No fix stated |
| WP responsive FAQ with category plugin | 3.9.5 | No fix stated |
| WP News and Scrolling Widgets | 5.0.6 | No fix stated |