Vulnerabilidades de Essentialplugin
CVEs publicadas que afetam produtos de Essentialplugin: 8 registro(s), com severidade, exploração e correções.
Album and Image Gallery Plus Lightbox 2Accordion and Accordion Slider 2Featured Post Creative 2WP Logo Showcase Responsive Slider and Carousel 2Portfolio and Projects 2WP News and Scrolling Widgets 1WP responsive FAQ with category plugin 1WP Slick Slider and Image Carousel 1WP Responsive Recent Post Slider/Carousel 1Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget 1Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions 1Video gallery and Player 1Team Slider and Team Grid Showcase plus Team Carousel 1Blog Designer – Post and Widget 1Countdown Timer Ultimate 1WP Blog and Widgets 1Timeline and History slider 1Meta Slider and Carousel with Lightbox 1Trending/Popular Post Slider and Widget 1Post Ticker Ultimate 1WP Featured Content and Slider 1Post grid and filter ultimate 1Slider a SlidersPack 1Essential Chat Support 1
CVE-2023-40200
Média · 5.3
CWE-639 11/06/2026
WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability
Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.
CVE-2026-8681
Média · 5.3
CWE-862 16/05/2026
Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.
CVE-2026-6443
Crítica · 9.8
CWE-506 17/04/2026
Plugins Essentialplugin para WordPress: backdoor incorporado (CWE-506)
Todos os plugins da Essentialplugin para WordPress são vulneráveis a um backdoor injetado em diversas versões. Isso se deve ao fato de o plugin ter sido vendido a um agente de ameaça malicioso que incorporou um backdoor em todos os plugins que adquiriu. Isso permite que o agente de ameaça mantenha um backdoor persistente e injete spam nos sites afetados.
CVE-2025-13612
Média · 6.4
CWE-79 19/02/2026
Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-0727
Média · 5.4
CWE-862 14/02/2026
Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification
The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'wp_aas_save_attachment_data' and 'wp_aas_get_attachment_edit_form' functions. This makes it possible for authenticated attackers, with contributor level access and above, to read and modify attachment metadata including file paths, titles, captions, alt text, and custom links for any attachment on the site.
CVE-2022-46845
Média · 5.3
CWE-862 09/12/2025
WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SlidersPack: from n/a before 2.3.
CVE-2025-67470
Média · 4.3
CWE-497 09/12/2025
WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
CVE-2025-66106
Média · 4.3
CWE-862 21/11/2025
WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.