Coolclock Vulnerabilities

The CoolClock plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 4.3.8. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.3.8

Fixed in:

4.3.8

Disclosed:

Sep 11, 2026

CVE-2026-83545 on NVD →

The CoolClock plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.3.7

Fixed in:

4.3.8

Disclosed:

Sep 8, 2026

CVE-2026-83546 on NVD →

The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks

CVSS:

5.4

(Wordfence)

Affected:

up to 4.3.5

Fixed in:

4.3.5

Disclosed:

Aug 30, 2021

CVE-2021-24670 on NVD →