CVE-2022-4950

CVE-2022-4950 affects WordPress plugins developed by Cool Plugins. Affected component is arbitrary plugin installation/activation that can lead to remote code execution by authenticated users with minimal permissions (e.g., subscriber). Attack vector inferred as network-based from CVSS metrics, w...

CVE-2020-36738

The CVE pertains to the WordPress plugin Cool Timeline (Horizontal & Vertical Timeline). A CSRF vulnerability exists in versions up to 2.0.2 due to missing or incorrect nonce validation in the ctl_save() function, enabling unauthenticated attackers to save field icons via forged requests if they ...