Cross-Site Scripting Vulnerability in CoolClock Plugin by WordPress
CVE-2026-83546
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-83546?
The CoolClock plugin for WordPress before version 4.3.8 contains a vulnerability that fails to properly escape a skin setting before rendering it within an HTML attribute. This oversight permits users with contributor-level access or higher to inject arbitrary web scripts into the page. When the content is viewed, these scripts can execute in the context of other users' browsers, potentially leading to data theft, session hijacking, or other malicious activities.
Affected Version(s)
CoolClock 0 < 4.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.