Description

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-11T07:16:46.950Z",
  "pubdate": "2026-09-11T07:16:46.950Z",
  "executiveSummary": "The CoolClock WordPress plugin prior to version 4.3.8 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from the improper sanitization and escaping of user-supplied data within a custom skin configuration setting.\nThe vulnerability allows an authenticated attacker, specifically those with contributor-level privileges or higher, to inject malicious JavaScript into the plugin's settings. When the affected content is rendered or viewed by other users, including high-privileged administrators, the injected script executes within the context of their session.\nThis presents a significant security risk, as successful exploitation could lead to unauthorized actions performed on behalf of the victim, session hijacking, or the defacement of the affected WordPress site. The attack does not require advanced network-level access, but relies on the attacker having the ability to modify plugin-specific settings within the WordPress dashboard.\nGiven the potential for privilege escalation or administrative account takeover, this vulnerability is classified as a critical threat to the integrity and security of the WordPress installation. Users are strongly advised to update to the latest patched version of the plugin to mitigate these risks.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw occurring due to the insecure handling of input within the CoolClock plugin. Specifically, the plugin permits the definition of a 'custom skin' setting which is subsequently rendered directly into the Document Object Model (DOM) via an inline <script> tag without adequate output escaping or sanitization processes.\nThe root cause of this vulnerability lies in the failure of the plugin's backend code to implement standard WordPress security functions, such as esc_js() or esc_attr(), when processing the 'custom skin' value before outputting it into the front-end or administrative interface. Because the data is stored in the WordPress database and retrieved during subsequent page renders, the payload becomes persistent.\nThe attack flow proceeds as follows: First, an attacker with contributor-level permissions navigates to the CoolClock settings page. Second, the attacker manipulates the custom skin configuration field, injecting a crafted JavaScript payload—for instance, a script designed to steal session cookies or perform unauthorized API requests. Third, upon saving these settings, the malicious code is stored in the WordPress options table. Fourth, when an administrator or any other user accesses a page or post where the CoolClock plugin generates its output, the web browser parses the inline script tag and executes the attacker's injected code within the origin of the WordPress site.\nBecause the payload executes in the context of the victim's session, the attacker can leverage the victim's permissions to perform sensitive actions. If the victim is an administrator, the attacker could effectively gain full control over the site by creating new administrative accounts, altering site settings, or exfiltrating sensitive data from the database. The vulnerability is explicitly present in all versions of the CoolClock plugin released prior to 4.3.8. Exploitation requires authenticated access to the WordPress dashboard with at least contributor privileges, rendering this a privilege-based XSS attack rather than an unauthenticated entry point."
}