CVE:CVE-2022-4950
CNNVD:CNNVD-202306-433
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress多个Cool Plugins开发的插件存在安全漏洞，该漏洞源于容易受到任意插件安装和激活的影响，这可能导致经过身份验证的攻击者以最小权限（例如订阅者）远程执行代码。
solution:Upgrade coolplugins cool_timeline to a higher version than 2.4,and avoid the version (,2.4); Upgrade coolplugins cryptocurrency_widgets to a higher version than 2.5.1,and avoid the version (,2.5.1); Upgrade coolplugins cryptocurrency_widgets_for_elementor to a higher version than 1.3,and avoid the version (,1.3); Upgrade coolplugins event_single_page_builder_for_the_event_calendar to a higher version than 1.6,and avoid the version (,1.6); Upgrade coolplugins events-notification-bar-addon to a higher version than 1.6,and avoid the version (,1.6); Upgrade coolplugins events_search_for_the_events_calendar to a higher version than 1.2,and avoid the version (,1.2); Upgrade coolplugins events_shortcodes_for_the_events_calendar to a higher version than 2.0,and avoid the version (,2.0); Upgrade coolplugins events_widgets_for_elementor_and_the_events_calendar to a higher version than 1.5,and avoid the version (,1.5); Upgrade coolplugins the_events_calendar_countdown_addon to a higher version than 1.4,and avoid the version (,1.4); Upgrade cryptocurrency_payment_&_donation_box_plugins cryptocurrency_payment_&_donation_box to a higher version than 1.8,and avoid the version (,1.8)