What’s Vulnerable › Vulnerabilities

CVE-2022-4950: Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-07 · updated 2026-06-17
• Weakness: CWE-862

Description

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

Affected products

• narinder-singh Cool Timeline (Horizontal & Vertical Timeline): before 2.4 — fixed in 2.4
• Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List: before 2.5.1 — fixed in 2.5.1
• coolplugins Cryptocurrency Widgets For Elementor: before 1.3 — fixed in 1.3
• coolplugins Event Single Page Builder For The Event Calendar: before 1.6 — fixed in 1.6
• coolplugins Events-Notification-Bar-Addon: before 1.6 — fixed in 1.6
• narinder-singh Events Search For The Events Calendar: before 1.2 — fixed in 1.2
• narinder-singh Events Shortcodes For The Events Calendar: before 2.0 — fixed in 2.0
• coolplugins Events Widgets For Elementor And The Events Calendar: before 1.5 — fixed in 1.5
• coolplugins The Events Calendar Countdown Addon: before 1.4 — fixed in 1.4
• Cryptocurrency Payment & Donation Box Plugins Cryptocurrency Payment & Donation Box: before 1.8 — fixed in 1.8

How to fix

Upgrade to a fixed version: narinder-singh Cool Timeline (Horizontal & Vertical Timeline) 2.4; Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List 2.5.1; coolplugins Cryptocurrency Widgets For Elementor 1.3; coolplugins Event Single Page Builder For The Event Calendar 1.6; coolplugins Events-Notification-Bar-Addon 1.6; narinder-singh Events Search For The Events Calendar 1.2; narinder-singh Events Shortcodes For The Events Calendar 2.0; coolplugins Events Widgets For Elementor And The Events Calendar 1.5; coolplugins The Events Calendar Countdown Addon 1.4; Cryptocurrency Payment & Donation Box Plugins Cryptocurrency Payment & Donation Box 1.8. Check the vendor advisory for mitigations.

References

• https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/
• https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve
• https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/
• https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve

Get alerted when CVE-2022-4950 or the next vulnerability affects your stack