Essentialplugin WordPress plugin portfolio: A security weakness
Essentialplugin WordPress plugin portfolio is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is 1.4.6, 1.5.6, 1.5.7, 1.7.4, 1.7.6, 1.8.6, 2.0.8, 2.1.8, 2.4.5, 2.6.6, 2.6.9, 2.7.7, 2.8.6, 2.8.7, 2.9.1, 3.5.6, 3.7.1, 3.7.8.1, 3.8.7, 3.9.5, 5.0.6.
- Component
- Accordion and Accordion Slider, Portfolio and Projects, Featured Post Creative, Post grid and filter ultimate, WP Featured Content and Slider, Post Ticker Ultimate, Trending/Popular Post Slider and Widget, Meta Slider and Carousel with Lightbox, Album and Image Gallery Plus Lightbox, Timeline and History slider, WP Blog and Widgets, Countdown Timer Ultimate, Blog Designer – Post and Widget, Team Slider and Team Grid Showcase plus Team Carousel, Video gallery and Player, Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions, Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget, WP Responsive Recent Post Slider/Carousel, WP Slick Slider and Image Carousel, WP Logo Showcase Responsive Slider and Carousel, WP responsive FAQ with category plugin, WP News and Scrolling Widgets
- Plugin slug
- Not applicable
- Affected
- 1.4.6, 1.5.6, 1.5.7, 1.7.4, 1.7.6, 1.8.6, 2.0.8, 2.1.8, 2.4.5, 2.6.6, 2.6.9, 2.7.7, 2.8.6, 2.8.7, 2.9.1, 3.5.6, 3.7.1, 3.7.8.1, 3.8.7, 3.9.5, 5.0.6
- Safe version
- See mitigation notes
- Published
- Apr 17, 2026
Update, patch or deactivate.
Update Essentialplugin WordPress plugin portfolio to a release outside the affected range, or disable and remove it until a fixed version is available.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H