CVE-2022-4950highCWE-862

CVE-2022-4950: high-severity vulnerability in blackworks1 Cryptocurrency Donation Box…

Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation

Published · Updated

Follow this CVE+ Monitor Cryptocurrency Donation Box – Bitcoin & Crypto Donations+ Monitor Cryptocurrency Widgets For Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.4%
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
blackworks1 · Cryptocurrency Donation Box – Bitcoin & Crypto Donationscoolplugins · Cryptocurrency Widgets For Elementorcoolplugins · Events Widgets For Elementor And The Events Calendarnarinder-singh · Cool Timeline (Horizontal & Vertical Timeline)narinder-singh · Cryptocurrency Widgets – Price Ticker & Coins Listnarinder-singh · Event Countdown for The Events Calendarnarinder-singh · Event Single Page Builder For The Events Calendarnarinder-singh · Events Search For The Events Calendarnarinder-singh · Events Shortcodes For The Events Calendarnarinder-singh · The Events Calendar Events Notification Bar Addon
Related CVEs — blackworks1 Cryptocurrency Donation Box…

In the same product, most dangerous first.

CVE-2026-93885HIGHCryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object ParameterEPSS 0.4%