CVE-2026-6443 — Vulnerability intelligence
essentialplugin — Accordion and Accordion Slider, Portfolio and Projects, Featured Post Creative, Post grid and filter ultimate, WP Featured Content and Slider, Post Ticker Ultimate, Trending/Popular Post Slider and Widget, Meta Slider and Carousel with Lightbox, Album and Image Gallery Plus Lightbox, Timeline and History slider, WP Blog and Widgets, Countdown Timer Ultimate, Blog Designer – Post and Widget, Team Slider and Team Grid Showcase plus Team Carousel, Video gallery and Player, Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions, Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget, WP Responsive Recent Post Slider/Carousel, WP Slick Slider and Image Carousel, WP Logo Showcase Responsive Slider and Carousel, WP responsive FAQ with category plugin, WP News and Scrolling Widgets
Published:
- CVSS
- 9.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.