Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation

8.8 CVSS

Vulnerability Description

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-4950

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Jerome Bruandet

References

More from narinder-singh

View All →

CVE-2024-0977

Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium 4.4

CVE-2024-0709

The Cryptocurrency Widgets – Price Ticker & Coins List plugin...

Critical 9.8

CVE-2021-4413

Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass

Medium 4.3

CVE-2021-4349

Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery

High 8.8

CVE-2020-36738

Cool Timeline (Horizontal & Vertical Timeline) <= 2.0.2 - Cross-Site Request Forgery Bypass

Medium 4.3

Affected Vendor

narinder-singh

View all reports →

Affected Software

The Events Calendar Events Notification Bar Addon, Events Search For The Events Calendar, Cryptocurrency Widgets For Elementor, Event Countdown for The Events Calendar, Events Widgets For Elementor And The Events Calendar, Event Single Page Builder For The Events Calendar, Cryptocurrency Donation Box – Bitcoin & Crypto Donations, Events Shortcodes For The Events Calendar, Cool Timeline (Horizontal & Vertical Timeline), Cryptocurrency Widgets – Price Ticker & Coins List

Vulnerable Versions: