CVE-2022-4950

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4950

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

S

everal WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

References
Link Resource
https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/ Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve Broken Link Third Party Advisory
https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/ Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve Broken Link Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:coolplugins:cool_timeline:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:cryptocurrency_widgets:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:cryptocurrency_widgets_for_elementor:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:event_single_page_builder_for_the_event_calendar:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:events-notification-bar-addon:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:events_search_for_the_events_calendar:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:events_shortcodes_for_the_events_calendar:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:events_widgets_for_elementor_and_the_events_calendar:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:coolplugins:the_events_calendar_countdown_addon:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:cryptocurrency_payment_\&_donation_box_plugins:cryptocurrency_payment_\&_donation_box:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 07:36

Type Values Removed Values Added
References () https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/ - Third Party Advisory () https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/ - Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php - Patch () https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve - Broken Link, Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve - Broken Link, Third Party Advisory
Information

Published : 2023-06-07 02:15

Updated : 2024-11-21 07:36

NVD link : CVE-2022-4950

Mitre link : CVE-2022-4950

CVE.ORG link : CVE-2022-4950

JSON object : View

Products Affected

coolplugins

cryptocurrency_payment_\&_donation_box_plugins

CWE
CWE-862

Missing Authorization