CVE-2026-83545

5th percentile - higher than 5% of all known CVEs

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script. This allows users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

A malicious contributor can inject JavaScript that executes in visitors' browsers, potentially resulting in session data theft or account takeover. The risk affects anyone viewing the infected content.

Update the CoolClock plugin to version 4.3.8 or later. Verify existing content for injected JavaScript.