CVE-2026-83546

MediumCVSS 6.8

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

Risk Assessment

An attacker with contributor-level access can inject a malicious script that executes in visitors' browsers, potentially leading to session or data theft. This affects all users viewing the infected content.

Recommendation

Update the CoolClock plugin to version 4.3.8 or later. Review existing content for injected scripts.

Other vulnerabilities in CoolClock WordPress plugin

CVE-2026-83545Medium
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script. This allows users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

Original NVD description (English source)

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS