CVE-2026-6443

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-506

Affected software

VendorProductVersions
essentialpluginAccordion and Accordion Slider1.4.6
essentialpluginPortfolio and Projects1.5.6
essentialpluginFeatured Post Creative1.5.7
essentialpluginPost grid and filter ultimate1.7.4
essentialpluginWP Featured Content and Slider1.7.6
essentialpluginPost Ticker Ultimate1.7.6
essentialpluginTrending/Popular Post Slider and Widget1.8.6
essentialpluginMeta Slider and Carousel with Lightbox2.0.8
essentialpluginAlbum and Image Gallery Plus Lightbox2.1.8
essentialpluginTimeline and History slider2.4.5
essentialpluginWP Blog and Widgets2.6.6
essentialpluginCountdown Timer Ultimate2.6.9
essentialpluginBlog Designer – Post and Widget2.7.7
essentialpluginTeam Slider and Team Grid Showcase plus Team Carousel2.8.6
essentialpluginVideo gallery and Player2.8.7
essentialpluginPopup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions2.9.1
essentialpluginTestimonial Grid and Testimonial Slider plus Carousel with Rotator Widget3.5.6
essentialpluginWP Responsive Recent Post Slider/Carousel3.7.1
essentialpluginWP Slick Slider and Image Carousel3.7.8.1
essentialpluginWP Logo Showcase Responsive Slider and Carousel3.8.7
essentialpluginWP responsive FAQ with category plugin3.9.5
essentialpluginWP News and Scrolling Widgets5.0.6

References

Timeline

Published
Apr 17, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-644307.5In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_CVE-2026-644317.8In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_mst_fixup() for invalid index_block ntfCVE-2026-644327.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns ICVE-2026-644337.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete addCVE-2026-644348.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capCVE-2026-644358.2In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue MultipCVE-2026-644367.1In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_sCVE-2026-644378.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMCVE-2026-644388.8In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The CVE-2026-644399.8In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aeaCVE-2026-64448.6A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, accesCVE-2026-644408.1In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler
CVE-2026-6443: Critical severity, CVSS 9.8 | Vulnix