# Essentialplugin Plugins (Various Versions) - Injected Backdoor CVE record · `CVE-2026-6443` - **Identifiers:** `CVE-2026-6443` - **State:** Confirmed - **Severity:** CVSS 9.8 Critical - **Critical:** Yes: CVSS 9+ - **CNA:** Wordfence - **Weakness (CWE):** [CWE-506](https://cwe.mitre.org/data/definitions/506.html) - **Tags:** [CWE-506](https://agentprime.io/advisories/tag/cwe-506.md) - **Technologies:** [essentialplugin Accordion and Accordion Slider](https://agentprime.io/advisories/technology/essentialplugin-accordion-and-accordion-slider.md) · [essentialplugin Portfolio and Projects](https://agentprime.io/advisories/technology/essentialplugin-portfolio-and-projects.md) · [essentialplugin Featured Post Creative](https://agentprime.io/advisories/technology/essentialplugin-featured-post-creative.md) · [essentialplugin Post grid and filter ultimate](https://agentprime.io/advisories/technology/essentialplugin-post-grid-and-filter-ultimate.md) · [essentialplugin WP Featured Content and Slider](https://agentprime.io/advisories/technology/essentialplugin-wp-featured-content-and-slider.md) · [essentialplugin Post Ticker Ultimate](https://agentprime.io/advisories/technology/essentialplugin-post-ticker-ultimate.md) · [essentialplugin Trending/Popular Post Slider and Widget](https://agentprime.io/advisories/technology/essentialplugin-trending-popular-post-slider-and-widget.md) · [essentialplugin Meta Slider and Carousel with Lightbox](https://agentprime.io/advisories/technology/essentialplugin-meta-slider-and-carousel-with-lightbox.md) · [essentialplugin Album and Image Gallery Plus Lightbox](https://agentprime.io/advisories/technology/essentialplugin-album-and-image-gallery-plus-lightbox.md) · [essentialplugin Timeline and History slider](https://agentprime.io/advisories/technology/essentialplugin-timeline-and-history-slider.md) · [essentialplugin WP Blog and Widgets](https://agentprime.io/advisories/technology/essentialplugin-wp-blog-and-widgets.md) · [essentialplugin Countdown Timer Ultimate](https://agentprime.io/advisories/technology/essentialplugin-countdown-timer-ultimate.md) · [essentialplugin Blog Designer – Post and Widget](https://agentprime.io/advisories/technology/essentialplugin-blog-designer-post-and-widget.md) · [essentialplugin Team Slider and Team Grid Showcase plus Team Carousel](https://agentprime.io/advisories/technology/essentialplugin-team-slider-and-team-grid-showcase-plus-team-carousel.md) · [essentialplugin Video gallery and Player](https://agentprime.io/advisories/technology/essentialplugin-video-gallery-and-player.md) · [essentialplugin Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions](https://agentprime.io/advisories/technology/essentialplugin-popup-maker-and-popup-anything-popup-for-opt-ins-and-lead-genera.md) · [essentialplugin Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget](https://agentprime.io/advisories/technology/essentialplugin-testimonial-grid-and-testimonial-slider-plus-carousel-with-rotat.md) · [essentialplugin WP Responsive Recent Post Slider/Carousel](https://agentprime.io/advisories/technology/essentialplugin-wp-responsive-recent-post-slider-carousel.md) · [essentialplugin WP Slick Slider and Image Carousel](https://agentprime.io/advisories/technology/essentialplugin-wp-slick-slider-and-image-carousel.md) · [essentialplugin WP Logo Showcase Responsive Slider and Carousel](https://agentprime.io/advisories/technology/essentialplugin-wp-logo-showcase-responsive-slider-and-carousel.md) - **Published:** 17 Apr 2026 - **Updated:** 21 Apr 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Wordfence) at 17 Apr 2026, 06:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Critical Critical, because: - CVSS score 9.8: 9.0 or more. How we decide what’s critical: ## Affected products, as the CNA wrote them - Vendor: essentialplugin. Product: Accordion and Accordion Slider. - affected: `1.4.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Portfolio and Projects. - affected: `1.5.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Featured Post Creative. - affected: `1.5.7` - Other versions: unaffected - Vendor: essentialplugin. Product: Post grid and filter ultimate. - affected: `1.7.4` - Other versions: unaffected - Vendor: essentialplugin. Product: WP Featured Content and Slider. - affected: `1.7.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Post Ticker Ultimate. - affected: `1.7.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Trending/Popular Post Slider and Widget. - affected: `1.8.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Meta Slider and Carousel with Lightbox. - affected: `2.0.8` - Other versions: unaffected - Vendor: essentialplugin. Product: Album and Image Gallery Plus Lightbox. - affected: `2.1.8` - Other versions: unaffected - Vendor: essentialplugin. Product: Timeline and History slider. - affected: `2.4.5` - Other versions: unaffected - Vendor: essentialplugin. Product: WP Blog and Widgets. - affected: `2.6.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Countdown Timer Ultimate. - affected: `2.6.9` - Other versions: unaffected - Vendor: essentialplugin. Product: Blog Designer – Post and Widget. - affected: `2.7.7` - Other versions: unaffected - Vendor: essentialplugin. Product: Team Slider and Team Grid Showcase plus Team Carousel. - affected: `2.8.6` - Other versions: unaffected - Vendor: essentialplugin. Product: Video gallery and Player. - affected: `2.8.7` - Other versions: unaffected - Vendor: essentialplugin. Product: Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions. - affected: `2.9.1` - Other versions: unaffected - Vendor: essentialplugin. Product: Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget. - affected: `3.5.6` - Other versions: unaffected - Vendor: essentialplugin. Product: WP Responsive Recent Post Slider/Carousel. - affected: `3.7.1` - Other versions: unaffected - Vendor: essentialplugin. Product: WP Slick Slider and Image Carousel. - affected: `3.7.8.1` - Other versions: unaffected - Vendor: essentialplugin. Product: WP Logo Showcase Responsive Slider and Carousel. - affected: `3.8.7` - Other versions: unaffected - Vendor: essentialplugin. Product: WP responsive FAQ with category plugin. - affected: `3.9.5` - Other versions: unaffected - Vendor: essentialplugin. Product: WP News and Scrolling Widgets. - affected: `5.0.6` - Other versions: unaffected ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Wordfence) - **CISA KEV:** Not listed. - **EPSS:** 0.0050, the 42nd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 17 Apr 2026. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2026-6443](https://www.cve.org/CVERecord?id=CVE-2026-6443) - [NVD: CVE-2026-6443](https://nvd.nist.gov/vuln/detail/CVE-2026-6443) ### References from the CNA - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .