Essential Plugin vulnerabilities

Products

• Slider a SlidersPack 2
• Featured Post Creative 1
• Hero Banner Ultimate 1
• Portfolio and Projects 1
• WP Logo Showcase Responsive Slider and Carousel 1

Latest Essential Plugin CVEs

Newest publication first

1. CVE-2023-40200 WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability

   Published 2026-06-11

   Medium·CVSS 5.3

   Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a...

2. CVE-2022-46845 WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability

   Published 2025-12-09

   Medium·CVSS 5.3

   Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SlidersPack: from n/a before 2.3.

3. CVE-2025-67470 WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability

   Published 2025-12-09

   Medium·CVSS 4.3

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.

4. CVE-2025-66106 WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability

   Published 2025-11-21

   Medium·CVSS 4.3

   Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.

5. CVE-2025-32152 WordPress Slider a SlidersPack Plugin <= 2.3 - Local File Inclusion vulnerability

   Published 2025-04-04

   High·CVSS 7.5

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Slider a SlidersPack sliderspack-all-in-one-image-sliders allows PHP Local File Inclusion.This issue affects Slider a SlidersPack: from n/a th...

6. CVE-2025-22305 WordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability

   Published 2025-01-07

   Medium·CVSS 6.5

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Hero Banner Ultimate hero-banner-ultimate allows PHP Local File Inclusion.This issue affects Hero Banner Ultimate: from n/a through <= 1.4.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.