Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation
Priority MEDIUM 43CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01366 71st percentileScored 2026-11-07
Fix Fixed Cryptocurrency Widgets For Elementor (coolplugins): 1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cool Plugins | The Events Calendar Events Notification Bar Addon | up to 1.1 | — | No fix listed | CNA |
| Cool Plugins | Events Search For The Events Calendar | up to 1.1.3 | — | No fix listed | CNA |
| Cool Plugins | Cryptocurrency Widgets For Elementor | before 1.3 | 1.3 | Patch available | CNA |
| Cool Plugins | Event Countdown for The Events Calendar | up to 1.3.1 | — | No fix listed | CNA |
| Cool Plugins | Events Widgets For Elementor And The Events Calendar | up to 1.4.2 | — | No fix listed | CNA |
| Cool Plugins | Event Single Page Builder For The Events Calendar | up to 1.5 | — | No fix listed | CNA |
| blackworks1 | Cryptocurrency Donation Box – Bitcoin & Crypto Donations | up to 1.7 | — | No fix listed | CNA |
| Cool Plugins | Events Shortcodes For The Events Calendar | up to 1.9.4 | — | No fix listed | CNA |
| Cool Plugins | Cool Timeline (Horizontal & Vertical Timeline) | up to 2.3.3 | — | No fix listed | CNA |
| Cool Plugins | Cryptocurrency Widgets – Price Ticker & Coins List | up to 2.4 | — | No fix listed | CNA |
- The Events Calendar Events Notification Bar Addon VendorCool Plugins Affected up to 1.1 Fixed in — No fix listed CNA
- Events Search For The Events Calendar VendorCool Plugins Affected up to 1.1.3 Fixed in — No fix listed CNA
- Cryptocurrency Widgets For Elementor VendorCool Plugins Affected before 1.3 Fixed in 1.3 Patch available CNA
- Event Countdown for The Events Calendar VendorCool Plugins Affected up to 1.3.1 Fixed in — No fix listed CNA
- Events Widgets For Elementor And The Events Calendar VendorCool Plugins Affected up to 1.4.2 Fixed in — No fix listed CNA
- Event Single Page Builder For The Events Calendar VendorCool Plugins Affected up to 1.5 Fixed in — No fix listed CNA
- Cryptocurrency Donation Box – Bitcoin & Crypto Donations Vendorblackworks1 Affected up to 1.7 Fixed in — No fix listed CNA
- Events Shortcodes For The Events Calendar VendorCool Plugins Affected up to 1.9.4 Fixed in — No fix listed CNA
- Cool Timeline (Horizontal & Vertical Timeline) VendorCool Plugins Affected up to 2.3.3 Fixed in — No fix listed CNA
- Cryptocurrency Widgets – Price Ticker & Coins List VendorCool Plugins Affected up to 2.4 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:coolplugins:cool_timeline:*:*:*:*:*:wordpress:*:* | before 2.4 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:cryptocurrency_widgets:*:*:*:*:*:wordpress:*:* | before 2.5.1 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:cryptocurrency_widgets_for_elementor:*:*:*:*:*:wordpress:*:* | before 1.3 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:event_single_page_builder_for_the_event_calendar:*:*:*:*:*:wordpress:*:* | before 1.6 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:events-notification-bar-addon:*:*:*:*:*:wordpress:*:* | before 1.6 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:events_search_for_the_events_calendar:*:*:*:*:*:wordpress:*:* | before 1.2 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:events_shortcodes_for_the_events_calendar:*:*:*:*:*:wordpress:*:* | before 2.0 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:events_widgets_for_elementor_and_the_events_calendar:*:*:*:*:*:wordpress:*:* | before 1.5 | Vulnerable | Cool Plugins |
| cpe:2.3:a:coolplugins:the_events_calendar_countdown_addon:*:*:*:*:*:wordpress:*:* | before 1.4 | Vulnerable | Cool Plugins |
| cpe:2.3:a:cryptocurrency_payment_\&_donation_box_plugins:cryptocurrency_payment_\&_donation_box:*:*:*:*:*:wordpress:*:* | before 1.8 | Vulnerable | Cryptocurrency Payment & Donation Box Plugins |
- cpe:2.3:a:coolplugins:cool_timeline:*:*:*:*:*:wordpress:*:* Versions before 2.4 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:cryptocurrency_widgets:*:*:*:*:*:wordpress:*:* Versions before 2.5.1 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:cryptocurrency_widgets_for_elementor:*:*:*:*:*:wordpress:*:* Versions before 1.3 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:event_single_page_builder_for_the_event_calendar:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:events-notification-bar-addon:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:events_search_for_the_events_calendar:*:*:*:*:*:wordpress:*:* Versions before 1.2 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:events_shortcodes_for_the_events_calendar:*:*:*:*:*:wordpress:*:* Versions before 2.0 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:events_widgets_for_elementor_and_the_events_calendar:*:*:*:*:*:wordpress:*:* Versions before 1.5 Vulnerable ·Cool Plugins
- cpe:2.3:a:coolplugins:the_events_calendar_countdown_addon:*:*:*:*:*:wordpress:*:* Versions before 1.4 Vulnerable ·Cool Plugins
- cpe:2.3:a:cryptocurrency_payment_\&_donation_box_plugins:cryptocurrency_payment_\&_donation_box:*:*:*:*:*:wordpress:*:* Versions before 1.8 Vulnerable ·Cryptocurrency Payment & Donation Box Plugins
Remediation
- Fix · CNA Cryptocurrency Widgets For Elementor (coolplugins) Fixed in 1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4950
- 2026-10-03 Alias added: GHSA-pwf8-fhfw-qvgq
References
More Cool Plugins Cool Timeline vulnerabilities
- TI-2020-18907 Cool Timeline (Horizontal & Vertical Timeline) <= 2.0.2 - Cross-Site Request Forgery Bypass CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-4950 · CVE Program
- CVE-2022-4950 · NVD
- FIRST EPSS
- GHSA-pwf8-fhfw-qvgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences