Skip to content
Sign in
6.8 Medium

CVE-2026-83546 The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an…

Description

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

Affected products and versions

Product Affected versions Fixed in
CoolClock 4.3 earliest → < 4.3.8 4.3.8

Other CVEs of CoolClock

The 2 CVEs of CoolClock →
CVE-2026-83545 The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside… 6.8 Medium
Track this CVE