Essentialplugin vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Essentialplugin products: 8 record(s), with severity, exploitation and fixes.

Album and Image Gallery Plus Lightbox 2 Accordion and Accordion Slider 2 Featured Post Creative 2 WP Logo Showcase Responsive Slider and Carousel 2 Portfolio and Projects 2 WP News and Scrolling Widgets 1 WP responsive FAQ with category plugin 1 WP Slick Slider and Image Carousel 1 WP Responsive Recent Post Slider/Carousel 1 Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget 1 Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions 1 Video gallery and Player 1 Team Slider and Team Grid Showcase plus Team Carousel 1 Blog Designer – Post and Widget 1 Countdown Timer Ultimate 1 WP Blog and Widgets 1 Timeline and History slider 1 Meta Slider and Carousel with Lightbox 1 Trending/Popular Post Slider and Widget 1 Post Ticker Ultimate 1 WP Featured Content and Slider 1 Post grid and filter ultimate 1 Slider a SlidersPack 1 Essential Chat Support 1

Exploited only (KEV) →

CVE-2023-40200 Medium · 5.3 CWE-639 Jun 11, 2026

WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability

Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.

CVE-2026-8681 Medium · 5.3 CWE-862 May 16, 2026

Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter

The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.

CVE-2026-6443 Critical · 9.8 CWE-506 Apr 17, 2026

Essentialplugin WordPress Plugins: Embedded Backdoor (CWE-506)

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

CVE-2025-13612 Medium · 6.4 CWE-79 Feb 19, 2026

Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode

The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-0727 Medium · 5.4 CWE-862 Feb 14, 2026

Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification

The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'wp_aas_save_attachment_data' and 'wp_aas_get_attachment_edit_form' functions. This makes it possible for authenticated attackers, with contributor level access and above, to read and modify attachment metadata including file paths, titles, captions, alt text, and custom links for any attachment on the site.

CVE-2022-46845 Medium · 5.3 CWE-862 Dec 9, 2025

WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SlidersPack: from n/a before 2.3.

CVE-2025-67470 Medium · 4.3 CWE-497 Dec 9, 2025

WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.

CVE-2025-66106 Medium · 4.3 CWE-862 Nov 21, 2025

WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.