CVE-2026-6443
Essentialplugin Plugins (Various Versions) - Injected Backdoor
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Essentialplugin Plugins (Various Versions) - Injected Backdoor
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
- Record
CVE-2026-6443- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-506
- Updated
- 2026-11-02
EUVDEUVD-2026-23384
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
- Record
EUVD-2026-23384- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c8jg-hc58-jrx2
The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in...
The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
- Record
GHSA-c8jg-hc58-jrx2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-506
- Updated
- 2026-11-02
NVD
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
- Record
CVE-2026-6443- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-506
- Updated
- 2026-11-02
Affected products
- essential plugin featured post creative
- essential plugin meta slider and carousel with lightbox
- essential plugin portfolio and projects
- essentialplugin accordion and accordion slider
- essentialplugin album and image gallery plus lightbox
- essentialplugin blog designer – post and widget
- essentialplugin countdown timer ultimate
- essentialplugin featured post creative
- essentialplugin meta slider and carousel with lightbox
- essentialplugin popup maker and popup anything – popup for opt-ins and lead generation conversions
- essentialplugin portfolio and projects
- essentialplugin post grid and filter ultimate
Show 17 moreShow less
- essentialplugin post ticker ultimate
- essentialplugin team slider and team grid showcase plus team carousel
- essentialplugin testimonial grid and testimonial slider plus carousel with rotator widget
- essentialplugin timeline and history slider
- essentialplugin trending/popular post slider and widget
- essentialplugin video gallery and player
- essentialplugin wp blog and widgets
- essentialplugin wp featured content and slider
- essentialplugin wp logo showcase responsive slider and carousel
- essentialplugin wp news and scrolling widgets
- essentialplugin wp responsive faq with category plugin
- essentialplugin wp responsive recent post slider/carousel
- essentialplugin wp slick slider and image carousel
- unknown wp blog and widgets
- wp onlinesupport, essential plugin timeline and history slider
- wp onlinesupport, essential plugin trending/popular post slider and widget
- wponlinesupport album and image gallery plus lightbox
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6443 is a critical vulnerability (CVSS 9.8) in Essential Plugin Featured Post Creative, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. No source names a fixed version.