Essentialplugin - vulnerabilities (CVEs)
16 CVEs in 30 products, 0 in the last 30 days, newest from 2026-05-16.
Products
- Album And Image Gallery Plus Lightbox - 3 CVEs
- Popup Anything - 3 CVEs
- Accordion And Accordion Slider - 2 CVEs
- Audio Player With Playlist Ultimate - 1 CVEs
- Blog Designer Post And Widget - 1 CVEs
- Countdown Timer Ultimate - 1 CVEs
- Download Post Category Image With Grid And Slider - 1 CVEs
- Essential Chat Support - 1 CVEs
- Featured Post Creative - 1 CVEs
- Hero Banner Ultimate - 1 CVEs
- Meta Slider And Carousel With Lightbox - 1 CVEs
- Popup Maker And Popup Anything Popup For Opt-ins And Lead Generation Conversions - 1 CVEs
- Portfolio And Projects - 1 CVEs
- Post Grid And Filter Ultimate - 1 CVEs
- Post Ticker Ultimate - 1 CVEs
- Preloader - 1 CVEs
- Product Slider And Carousel With Category With Woocommerce - 1 CVEs
- Team Slider And Team Grid Showcase Plus Team Carousel - 1 CVEs
- Testimonial Grid And Testimonial Slider Plus Carousel With Rotator Widget - 1 CVEs
- Timeline And History Slider - 1 CVEs
- Trendingpopular Post Slider And Widget - 1 CVEs
- Video Gallery And Player - 1 CVEs
- Wp Blog And Widget - 1 CVEs
- Wp Blog And Widgets - 1 CVEs
- Wp Featured Content And Slider - 1 CVEs
- Wp Logo Showcase Responsive Slider And Carousel - 1 CVEs
- Wp News And Scrolling Widgets - 1 CVEs
- Wp Responsive Faq With Category Plugin - 1 CVEs
- Wp Responsive Recent Post Slidercarousel - 1 CVEs
- Wp Slick Slider And Image Carousel - 1 CVEs
Newest CVEs of Essentialplugin
- CVE-2026-8681 - CVSS 5.3 (medium), 2026-05-16: The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin…
- CVE-2026-6443 - CVSS 9.8 (critical), 2026-04-17: All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious…
- CVE-2025-13612 - CVSS 6.4 (medium), 2026-02-19: The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode…
- CVE-2026-0727 - CVSS 5.4 (medium), 2026-02-14: The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the…
- CVE-2023-30488 - CVSS 5.3 (medium), 2024-12-09: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control…
- CVE-2023-25703 - CVSS 5.3 (medium), 2024-12-09: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured…
- CVE-2023-48273 - CVSS 5.3 (medium), 2024-06-11: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Preloader for Website.This issue affects Preloader for Website: from n/a through…
- CVE-2024-4194 - CVSS 7.3 (high), 2024-06-06: The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.…
- CVE-2023-38516 - CVSS 6.5 (medium), 2023-09-03: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2…
- CVE-2022-45818 - CVSS 6.5 (medium), 2023-05-04: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin <= 1.3.4 versions.
- CVE-2022-38077 - CVSS 8.8 (high), 2023-03-29: Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions…
- CVE-2022-4791 - CVSS 5.4 (medium), 2023-02-21: The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which…
- CVE-2022-4824 - CVSS 5.4 (medium), 2023-02-06: The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page,…
- CVE-2022-4747 - CVSS 5.4 (medium), 2023-02-06: The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting…
- CVE-2022-2115 - CVSS 6.1 (medium), 2022-07-25: The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected…
- CVE-2021-24883 - CVSS 5.4 (medium), 2021-11-29: The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as…
