Skip to content
Fencer Vulns
high 8.8

CVE-2022-4950 json

Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation

published 2023-06-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52203

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

Patch / fix

  • coolplugins Cryptocurrency Widgets For Elementor 1.3

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • narinder-singh The Events Calendar Events Notification Bar Addon
  • narinder-singh Events Search For The Events Calendar
  • coolplugins Cryptocurrency Widgets For Elementor
  • narinder-singh Event Countdown for The Events Calendar
  • coolplugins Events Widgets For Elementor And The Events Calendar
  • narinder-singh Event Single Page Builder For The Events Calendar
  • blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations
  • narinder-singh Events Shortcodes For The Events Calendar
  • narinder-singh Cool Timeline (Horizontal & Vertical Timeline)
  • narinder-singh Cryptocurrency Widgets – Price Ticker & Coins List

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.