Executive brief
CoolClock is a WordPress plugin that adds clock display functionality to websites. The plugin fails to properly escape user-supplied settings when injecting them into JavaScript code, allowing contributors and higher-privileged users to inject malicious scripts that execute whenever the page is viewed. This can lead to unauthorized actions on behalf of viewers, including editors and administrators.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79) in how CoolClock handles the custom skin parameter. The plugin does not escape the skin setting before outputting it inside an inline script tag, enabling attackers with contributor-level access or above to inject arbitrary JavaScript code via shortcode parameters. The injected payload persists in the WordPress database and executes in the browser context of anyone viewing or previewing the affected post. The vulnerability is fixed in version 4.3.8.
Affected products
- CoolClock CoolClock before 4.3.8
Timeline
- 2026-09-08: disclosed
- 2026-09-11: patched: Version 4.3.8 released