CVE-2026-83545: CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

Q: Who can exploit this issue?

A user with contributor-level access or higher can inject arbitrary JavaScript through the custom skin setting. Exploitation requires access to an account with at least that role.

Q: When does the injected JavaScript execute?

The JavaScript executes when content containing the malicious custom skin setting is viewed.

Q: How can I determine whether my site is affected?

Sites using versions of the CoolClock WordPress plugin before 4.3.8 are affected. Review contributor and higher-privileged users' custom skin JSON settings for unexpected script content.

Published Sep 11, 2026

Updated

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

Affected Software

1 affected component

CoolClock WordPress plugin<4.3.8

Event History

Sep 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher can inject arbitrary JavaScript through the custom skin setting. Exploitation requires access to an account with at least that role.

When does the injected JavaScript execute?

The JavaScript executes when content containing the malicious custom skin setting is viewed.

How can I determine whether my site is affected?

Sites using versions of the CoolClock WordPress plugin before 4.3.8 are affected. Review contributor and higher-privileged users' custom skin JSON settings for unexpected script content.