Essentialplugin Plugins (Various Versions) - Injected Backdoor
Priority MEDIUM 49CWE-506Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-506.
Summary
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WP OnlineSupport, Essential Plugin | Accordion and Accordion Slider | 1.4.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Portfolio and Projects | 1.5.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Featured Post Creative | 1.5.7 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Post grid and filter ultimate | 1.7.4 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP Featured Content and Slider | 1.7.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Post Ticker Ultimate | 1.7.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Trending/Popular Post Slider and Widget | 1.8.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Meta Slider and Carousel with Lightbox | 2.0.8 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Album and Image Gallery Plus Lightbox | 2.1.8 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Timeline and History slider | 2.4.5 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP Blog and Widgets | 2.6.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Countdown Timer Ultimate | 2.6.9 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Blog Designer – Post and Widget | 2.7.7 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Team Slider and Team Grid Showcase plus Team Carousel | 2.8.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Video gallery and Player | 2.8.7 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions | 2.9.1 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget | 3.5.6 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP Responsive Recent Post Slider/Carousel | 3.7.1 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP Slick Slider and Image Carousel | 3.7.8.1 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP Logo Showcase Responsive Slider and Carousel | 3.8.7 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP responsive FAQ with category plugin | 3.9.5 | — | No fix listed | CNA |
| WP OnlineSupport, Essential Plugin | WP News and Scrolling Widgets | 5.0.6 | — | No fix listed | CNA |
- Accordion and Accordion Slider VendorWP OnlineSupport, Essential Plugin Affected 1.4.6 Fixed in — No fix listed CNA
- Portfolio and Projects VendorWP OnlineSupport, Essential Plugin Affected 1.5.6 Fixed in — No fix listed CNA
- Featured Post Creative VendorWP OnlineSupport, Essential Plugin Affected 1.5.7 Fixed in — No fix listed CNA
- Post grid and filter ultimate VendorWP OnlineSupport, Essential Plugin Affected 1.7.4 Fixed in — No fix listed CNA
- WP Featured Content and Slider VendorWP OnlineSupport, Essential Plugin Affected 1.7.6 Fixed in — No fix listed CNA
- Post Ticker Ultimate VendorWP OnlineSupport, Essential Plugin Affected 1.7.6 Fixed in — No fix listed CNA
- Trending/Popular Post Slider and Widget VendorWP OnlineSupport, Essential Plugin Affected 1.8.6 Fixed in — No fix listed CNA
- Meta Slider and Carousel with Lightbox VendorWP OnlineSupport, Essential Plugin Affected 2.0.8 Fixed in — No fix listed CNA
- Album and Image Gallery Plus Lightbox VendorWP OnlineSupport, Essential Plugin Affected 2.1.8 Fixed in — No fix listed CNA
- Timeline and History slider VendorWP OnlineSupport, Essential Plugin Affected 2.4.5 Fixed in — No fix listed CNA
- WP Blog and Widgets VendorWP OnlineSupport, Essential Plugin Affected 2.6.6 Fixed in — No fix listed CNA
- Countdown Timer Ultimate VendorWP OnlineSupport, Essential Plugin Affected 2.6.9 Fixed in — No fix listed CNA
- Blog Designer – Post and Widget VendorWP OnlineSupport, Essential Plugin Affected 2.7.7 Fixed in — No fix listed CNA
- Team Slider and Team Grid Showcase plus Team Carousel VendorWP OnlineSupport, Essential Plugin Affected 2.8.6 Fixed in — No fix listed CNA
- Video gallery and Player VendorWP OnlineSupport, Essential Plugin Affected 2.8.7 Fixed in — No fix listed CNA
- Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions VendorWP OnlineSupport, Essential Plugin Affected 2.9.1 Fixed in — No fix listed CNA
- Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget VendorWP OnlineSupport, Essential Plugin Affected 3.5.6 Fixed in — No fix listed CNA
- WP Responsive Recent Post Slider/Carousel VendorWP OnlineSupport, Essential Plugin Affected 3.7.1 Fixed in — No fix listed CNA
- WP Slick Slider and Image Carousel VendorWP OnlineSupport, Essential Plugin Affected 3.7.8.1 Fixed in — No fix listed CNA
- WP Logo Showcase Responsive Slider and Carousel VendorWP OnlineSupport, Essential Plugin Affected 3.8.7 Fixed in — No fix listed CNA
- WP responsive FAQ with category plugin VendorWP OnlineSupport, Essential Plugin Affected 3.9.5 Fixed in — No fix listed CNA
- WP News and Scrolling Widgets VendorWP OnlineSupport, Essential Plugin Affected 5.0.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6443
- 2026-10-03 Alias added: GHSA-c8jg-hc58-jrx2
- 2026-10-20 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More WP OnlineSupport, Essential Plugin vulnerabilities
- TI-2022-04420 WP Blog and Widget < 2.3.1 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2022-04387 Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2022-04343 Post Category Image With Grid and Slider < 1.4.8 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2024-28885 WordPress Timeline and History slider plugin <= 2.3 - Local File Inclusion vulnerability CVSS 3.1HIGH 8.5
- TI-2024-03901 Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1HIGH 7.3
- TI-2022-17790 WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
Sources
- CVE-2026-6443 · CVE Program
- CVE-2026-6443 · NVD
- FIRST EPSS
- GHSA-c8jg-hc58-jrx2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences