CVE-2026-83545

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

Score

CVSS 3.1 6.8 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-11

Last modified

2026-09-11

Weaknesses

CWE-79

Affected products

• Coolclock (Unknown)

References

• https://wpscan.com/vulnerability/d331d834-08f7-46e2-859a-7b797213ad0b/