Description

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-11T07:16:47.050Z",
  "pubdate": "2026-09-11T07:16:47.050Z",
  "executiveSummary": "The CoolClock WordPress plugin prior to version 4.3.8 contains a stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from an improper neutralization of user-supplied input within the plugin's skin configuration settings.\nBy injecting malicious JavaScript into the skin attribute, authenticated users with at least contributor-level privileges can execute arbitrary code within the context of the victim's browser.\nThe impact includes the potential for session hijacking, unauthorized actions performed on behalf of administrative users, and the exfiltration of sensitive site data.\nSuccessful exploitation requires the attacker to have an active account with contributor or higher permissions, allowing them to modify plugin settings that are subsequently rendered in the WordPress administrative interface or front-end pages.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from a lack of adequate output encoding or input sanitization on the 'skin' setting parameter utilized by the CoolClock plugin.\nThe root cause is the plugin's failure to sanitize or escape user-controlled data before reflecting it directly into an HTML attribute within the document object model (DOM).\nIn the affected versions prior to 4.3.8, the plugin processes the skin configuration value and outputs it directly into the HTML without sanitization, allowing for the injection of arbitrary characters such as quotes and brackets that break out of the intended attribute context.\nThe attack flow proceeds as follows: An authenticated user with contributor privileges or higher navigates to the plugin settings menu. The attacker modifies the skin setting by injecting a crafted payload, such as '\" onmouseover=\"alert(document.cookie)\"'.\nBecause the input is not sanitized, the application stores this malicious string in the database. When the page containing the CoolClock widget is rendered, the application retrieves the stored value and places it inside the target HTML attribute. When a legitimate user or administrator views the page, the injected payload is executed by the browser.\nThe exploit leverages the trust relationship between the user's browser and the WordPress application. Once the payload is triggered, the attacker's script executes within the security context of the victim's session.\nPost-exploitation impact includes the ability to perform actions on behalf of the victim, bypass CSRF protections, capture sensitive cookies, or redirect users to malicious domains. The vulnerability is persistent, meaning the payload remains active until the configuration is manually corrected or the plugin is updated.\nThis vulnerability highlights the critical importance of context-aware output encoding (such as esc_attr() in WordPress) when reflecting user input within HTML attributes, as failing to do so provides a direct vector for script injection."
}