Essentialplugin
13 CVEs across 30 Essentialplugin products. Browse Essentialplugin vulnerabilities, severities, and proof-of-concept exploits.
Essentialplugin products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8681 | Medium | 5.3 | 2026-05-16 | The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin no… |
CVE-2026-6443 | Critical | 9.8 | 2026-04-17 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious th… |
CVE-2025-13612 | Medium | 6.4 | 2026-02-19 | The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in… |
CVE-2026-0727 | Medium | 5.4 | 2026-02-14 | The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the p… |
CVE-2024-4194 | Medium | 6.5 | 2024-06-06 | The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. Th… |
CVE-2023-38516 | Medium | 6.5 | 2023-09-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2… |
CVE-2022-45818 | Medium | 6.5 | 2023-05-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin <= 1.3.4 versions. |
CVE-2022-38077 | Medium | 4.3 | 2023-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin… |
CVE-2022-4791 | Medium | 5.4 | 2023-02-21 | The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which c… |
CVE-2022-4824 | Medium | 5.4 | 2023-02-06 | The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4747 | Medium | 5.4 | 2023-02-06 | The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2022-2115 | Medium | 6.1 | 2022-07-25 | The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected… |
CVE-2021-24883 | Medium | 5.4 | 2021-11-29 | The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as C… |