361 lines
13 KiB
JSON
361 lines
13 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-6443",
|
||
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Wordfence",
|
||
"dateReserved": "2026-04-16T18:22:16.366Z",
|
||
"datePublished": "2026-04-17T06:44:49.128Z",
|
||
"dateUpdated": "2026-04-21T19:53:07.705Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"shortName": "Wordfence",
|
||
"dateUpdated": "2026-04-21T19:53:07.705Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Accordion and Accordion Slider",
|
||
"versions": [
|
||
{
|
||
"version": "1.4.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Portfolio and Projects",
|
||
"versions": [
|
||
{
|
||
"version": "1.5.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Featured Post Creative",
|
||
"versions": [
|
||
{
|
||
"version": "1.5.7",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Post grid and filter ultimate",
|
||
"versions": [
|
||
{
|
||
"version": "1.7.4",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP Featured Content and Slider",
|
||
"versions": [
|
||
{
|
||
"version": "1.7.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Post Ticker Ultimate",
|
||
"versions": [
|
||
{
|
||
"version": "1.7.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Trending/Popular Post Slider and Widget",
|
||
"versions": [
|
||
{
|
||
"version": "1.8.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Meta Slider and Carousel with Lightbox",
|
||
"versions": [
|
||
{
|
||
"version": "2.0.8",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Album and Image Gallery Plus Lightbox",
|
||
"versions": [
|
||
{
|
||
"version": "2.1.8",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Timeline and History slider",
|
||
"versions": [
|
||
{
|
||
"version": "2.4.5",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP Blog and Widgets",
|
||
"versions": [
|
||
{
|
||
"version": "2.6.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Countdown Timer Ultimate",
|
||
"versions": [
|
||
{
|
||
"version": "2.6.9",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Blog Designer – Post and Widget",
|
||
"versions": [
|
||
{
|
||
"version": "2.7.7",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Team Slider and Team Grid Showcase plus Team Carousel",
|
||
"versions": [
|
||
{
|
||
"version": "2.8.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Video gallery and Player",
|
||
"versions": [
|
||
{
|
||
"version": "2.8.7",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions",
|
||
"versions": [
|
||
{
|
||
"version": "2.9.1",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
|
||
"versions": [
|
||
{
|
||
"version": "3.5.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP Responsive Recent Post Slider/Carousel",
|
||
"versions": [
|
||
{
|
||
"version": "3.7.1",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP Slick Slider and Image Carousel",
|
||
"versions": [
|
||
{
|
||
"version": "3.7.8.1",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP Logo Showcase Responsive Slider and Carousel",
|
||
"versions": [
|
||
{
|
||
"version": "3.8.7",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP responsive FAQ with category plugin",
|
||
"versions": [
|
||
{
|
||
"version": "3.9.5",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
},
|
||
{
|
||
"vendor": "essentialplugin",
|
||
"product": "WP News and Scrolling Widgets",
|
||
"versions": [
|
||
{
|
||
"version": "5.0.6",
|
||
"status": "affected"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
|
||
}
|
||
],
|
||
"title": "Essentialplugin Plugins (Various Versions) - Injected Backdoor",
|
||
"references": [
|
||
{
|
||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"
|
||
},
|
||
{
|
||
"url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"description": "CWE-506 Embedded Malicious Code",
|
||
"cweId": "CWE-506",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Eu Joe Chegne"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Damien"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2026-04-16T18:38:10.000Z",
|
||
"lang": "en",
|
||
"value": "Vendor Notified"
|
||
},
|
||
{
|
||
"time": "2026-04-09T00:00:00.000Z",
|
||
"lang": "en",
|
||
"value": "Disclosed"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-04-17T18:49:32.019393Z",
|
||
"id": "CVE-2026-6443",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-04-17T18:49:42.999Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |