CVE-2026-6443 (GCVE-0-2026-6443)

Vulnerability from cvelistv5 – Published: 2026-04-17 06:44 – Updated: 2026-04-21 19:53
VLAI
Title
Essentialplugin Plugins (Various Versions) - Injected Backdoor
Summary
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-17 18:49 UTC
CWE
  • CWE-506 - Embedded Malicious Code
Assigner
References
Impacted products
Vendor Product Version CPE status
essentialplugin Accordion and Accordion Slider Affected: 1.4.6
guessed Create a notification for this product.
essentialplugin Portfolio and Projects Affected: 1.5.6
guessed Create a notification for this product.
essentialplugin Featured Post Creative Affected: 1.5.7
guessed Create a notification for this product.
essentialplugin Post grid and filter ultimate Affected: 1.7.4
guessed Create a notification for this product.
essentialplugin WP Featured Content and Slider Affected: 1.7.6
guessed Create a notification for this product.
essentialplugin Post Ticker Ultimate Affected: 1.7.6
guessed Create a notification for this product.
essentialplugin Trending/Popular Post Slider and Widget Affected: 1.8.6
guessed Create a notification for this product.
essentialplugin Meta Slider and Carousel with Lightbox Affected: 2.0.8
guessed Create a notification for this product.
essentialplugin Album and Image Gallery Plus Lightbox Affected: 2.1.8
guessed Create a notification for this product.
essentialplugin Timeline and History slider Affected: 2.4.5
guessed Create a notification for this product.
essentialplugin WP Blog and Widgets Affected: 2.6.6
guessed Create a notification for this product.
essentialplugin Countdown Timer Ultimate Affected: 2.6.9
guessed Create a notification for this product.
essentialplugin Blog Designer – Post and Widget Affected: 2.7.7
guessed Create a notification for this product.
essentialplugin Team Slider and Team Grid Showcase plus Team Carousel Affected: 2.8.6
guessed Create a notification for this product.
essentialplugin Video gallery and Player Affected: 2.8.7
guessed Create a notification for this product.
essentialplugin Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions Affected: 2.9.1
guessed Create a notification for this product.
essentialplugin Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget Affected: 3.5.6
guessed Create a notification for this product.
essentialplugin WP Responsive Recent Post Slider/Carousel Affected: 3.7.1
guessed Create a notification for this product.
essentialplugin WP Slick Slider and Image Carousel Affected: 3.7.8.1
guessed Create a notification for this product.
essentialplugin WP Logo Showcase Responsive Slider and Carousel Affected: 3.8.7
guessed Create a notification for this product.
essentialplugin WP responsive FAQ with category plugin Affected: 3.9.5
guessed Create a notification for this product.
essentialplugin WP News and Scrolling Widgets Affected: 5.0.6
guessed Create a notification for this product.
Credits
Eu Joe Chegne Damien
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:49:32.019393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:49:42.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Accordion and Accordion Slider",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Portfolio and Projects",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Featured Post Creative",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.7"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post grid and filter ultimate",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.4"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Featured Content and Slider",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post Ticker Ultimate",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Trending/Popular Post Slider and Widget",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Meta Slider and Carousel with Lightbox",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.8"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Album and Image Gallery Plus Lightbox",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.8"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Timeline and History slider",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.5"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Blog and Widgets",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Countdown Timer Ultimate",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.9"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Blog Designer \u2013 Post and Widget",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.7"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Slider and Team Grid Showcase plus Team Carousel",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Video gallery and Player",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.7"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "2.9.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Responsive Recent Post Slider/Carousel",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.7.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Slick Slider and Image Carousel",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.7.8.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Logo Showcase Responsive Slider and Carousel",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.7"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP responsive FAQ with category plugin",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.9.5"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP News and Scrolling Widgets",
          "vendor": "essentialplugin",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eu Joe Chegne"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Damien"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin\u0027s they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506 Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:53:07.705Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"
        },
        {
          "url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-16T18:38:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-09T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Essentialplugin Plugins (Various Versions) - Injected Backdoor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-6443",
    "datePublished": "2026-04-17T06:44:49.128Z",
    "dateReserved": "2026-04-16T18:22:16.366Z",
    "dateUpdated": "2026-04-21T19:53:07.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6443",
      "date": "2026-09-23",
      "epss": "0.00495",
      "percentile": "0.41558"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Accordion and Accordion Slider",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.4.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Portfolio and Projects",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.5.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Featured Post Creative",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.5.7"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Post grid and filter ultimate",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.7.4"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP Featured Content and Slider",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.7.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Post Ticker Ultimate",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.7.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Trending/Popular Post Slider and Widget",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.8.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Meta Slider and Carousel with Lightbox",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.0.8"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Album and Image Gallery Plus Lightbox",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.1.8"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Timeline and History slider",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.4.5"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP Blog and Widgets",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Countdown Timer Ultimate",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.9"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Blog Designer \u2013 Post and Widget",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.7.7"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Team Slider and Team Grid Showcase plus Team Carousel",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.8.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Video gallery and Player",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.8.7"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.9.1"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.5.6"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP Responsive Recent Post Slider/Carousel",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.7.1"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP Slick Slider and Image Carousel",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.7.8.1"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP Logo Showcase Responsive Slider and Carousel",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.8.7"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP responsive FAQ with category plugin",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.9.5"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "WP News and Scrolling Widgets",
                "vendor": "essentialplugin",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0.6"
                  }
                ]
              }
            ],
            "source": "security@wordfence.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin\u0027s they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
          }
        ],
        "id": "CVE-2026-6443",
        "lastModified": "2026-06-17T11:00:49.877",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "security@wordfence.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-6443",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:49:32.019393Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-17T07:16:03.160",
        "references": [
          {
            "source": "security@wordfence.com",
            "url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"
          }
        ],
        "sourceIdentifier": "security@wordfence.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-506"
              }
            ],
            "source": "security@wordfence.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-22T01:22:33+00:00",
      "cve": "CVE-2026-6443",
      "id": "CVE-2026-6443",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Essentialplugin Plugins (Various Versions) - Injected Backdoor",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6443.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-6443",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-17T18:49:32.019393Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-17T18:49:38.790Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Accordion and Accordion Slider",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.4.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Portfolio and Projects",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.5.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Featured Post Creative",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.5.7"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Post grid and filter ultimate",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.7.4"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP Featured Content and Slider",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.7.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Post Ticker Ultimate",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.7.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Trending/Popular Post Slider and Widget",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.8.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Meta Slider and Carousel with Lightbox",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.0.8"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Album and Image Gallery Plus Lightbox",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.1.8"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Timeline and History slider",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.4.5"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP Blog and Widgets",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Countdown Timer Ultimate",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.9"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Blog Designer \u2013 Post and Widget",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.7.7"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Team Slider and Team Grid Showcase plus Team Carousel",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.8.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Video gallery and Player",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.8.7"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.9.1"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.5.6"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP Responsive Recent Post Slider/Carousel",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.7.1"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP Slick Slider and Image Carousel",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.7.8.1"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP Logo Showcase Responsive Slider and Carousel",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.8.7"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP responsive FAQ with category plugin",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.9.5"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "WP News and Scrolling Widgets",
              "vendor": "essentialplugin",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.0.6"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Eu Joe Chegne"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damien"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin\u0027s they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-506",
                  "description": "CWE-506 Embedded Malicious Code",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-21T19:53:07.705Z",
            "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
            "shortName": "Wordfence"
          },
          "references": [
            {
              "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"
            },
            {
              "url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-04-16T18:38:10.000Z",
              "value": "Vendor Notified"
            },
            {
              "lang": "en",
              "time": "2026-04-09T00:00:00.000Z",
              "value": "Disclosed"
            }
          ],
          "title": "Essentialplugin Plugins (Various Versions) - Injected Backdoor"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "assignerShortName": "Wordfence",
        "cveId": "CVE-2026-6443",
        "datePublished": "2026-04-17T06:44:49.128Z",
        "dateReserved": "2026-04-16T18:22:16.366Z",
        "dateUpdated": "2026-04-21T19:53:07.705Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.