CVE-2022-4950
Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- narinder-singh The Events Calendar Events Notification Bar Addon
through 1.1
- narinder-singh Events Search For The Events Calendar
through 1.1.3
- coolplugins Cryptocurrency Widgets For Elementor
fixed in 1.3
- narinder-singh Event Countdown for The Events Calendar
through 1.3.1
- coolplugins Events Widgets For Elementor And The Events Calendar
through 1.4.2
- narinder-singh Event Single Page Builder For The Events Calendar
through 1.5
- blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations
through 1.7
- narinder-singh Events Shortcodes For The Events Calendar
through 1.9.4
- narinder-singh Cool Timeline (Horizontal & Vertical Timeline)
through 2.3.3
- narinder-singh Cryptocurrency Widgets – Price Ticker & Coins List
through 2.4