CVE-2022-4950: Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

high Affects cool-timeline (WordPress plugin), cryptocurrency-payment-\&-donation-box (WordPress plugin), cryptocurrency-widgets (WordPress plugin), cryptocurrency-widgets-for-elementor (WordPress plugin), event-single-page-builder-for-the-event-calendar (WordPress plugin), events-notification-bar-addon (WordPress plugin) and 4 more. Feed 2026.10.29.1, updated 2026-10-28; published 2023-06-07; advisory modified 2026-06-17.

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: cool-timeline (WordPress plugin) WordPress
Affected versions: <2.4
Fixed in: 2.4
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: cryptocurrency-payment-\&-donation-box (WordPress plugin) WordPress
Affected versions: <1.8
Fixed in: 1.8
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: cryptocurrency-widgets (WordPress plugin) WordPress
Affected versions: <2.5.1
Fixed in: 2.5.1
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: cryptocurrency-widgets-for-elementor (WordPress plugin) WordPress
Affected versions: <1.3
Fixed in: 1.3
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: event-single-page-builder-for-the-event-calendar (WordPress plugin) WordPress
Affected versions: <1.6
Fixed in: 1.6
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: events-notification-bar-addon (WordPress plugin) WordPress
Affected versions: <1.6
Fixed in: 1.6
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: events-search-for-the-events-calendar (WordPress plugin) WordPress
Affected versions: <1.2
Fixed in: 1.2
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: events-shortcodes-for-the-events-calendar (WordPress plugin) WordPress
Affected versions: <2.0
Fixed in: 2.0
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: events-widgets-for-elementor-and-the-events-calendar (WordPress plugin) WordPress
Affected versions: <1.5
Fixed in: 1.5
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permis

Package: the-events-calendar-countdown-addon (WordPress plugin) WordPress
Affected versions: <1.4
Fixed in: 1.4
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2023-06-07
Source: nvd

References

CWE-862

NVD record cool-timeline (WordPress plugin) advisories cryptocurrency-payment-\&-donation-box (WordPress plugin) advisories cryptocurrency-widgets (WordPress plugin) advisories cryptocurrency-widgets-for-elementor (WordPress plugin) advisories event-single-page-builder-for-the-event-calendar (WordPress plugin) advisories events-notification-bar-addon (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2020-36738 medium The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to C same package: cool-timeline (WordPress plugin)
CVE-2022-1329 high The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution same weakness: CWE-862
CVE-2023-6875 critical The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for Wo same weakness: CWE-862
CVE-2020-8772 critical The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization chec same weakness: CWE-862
CVE-2019-19985 medium The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowe same weakness: CWE-862
CVE-2022-0218 high The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauth same weakness: CWE-862