CVE-2026-83545 — CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

CVE-2026-83545

CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON PUBLISHED

Description (CNA)

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

Affected (CNA)

Vendor / product	Versions
Unknown / CoolClock	affected 0 before 4.3.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d331d834-08f7-46e2-859a-7b797213ad0b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.