CVE-2026-83545 Overview
CVE-2026-83545 is a stored Cross-Site Scripting (XSS) vulnerability in the CoolClock WordPress plugin versions prior to 4.3.8. The plugin fails to properly escape a custom skin setting before rendering it inside an inline script block. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected content. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level attackers can execute arbitrary JavaScript in the context of site visitors and administrators, enabling session hijacking, privilege escalation, and defacement.
Affected Products
- CoolClock WordPress plugin versions prior to 4.3.8
- WordPress sites permitting contributor-or-higher user registration
- Any WordPress installation with the vulnerable CoolClock plugin active
Discovery Timeline
- 2026-09-11 - CVE CVE-2026-83545 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-83545
Vulnerability Analysis
The CoolClock plugin renders clock widgets on WordPress pages by generating inline JavaScript that references user-configurable skin settings. The vulnerability stems from the plugin passing the custom skin value directly into an inline <script> block without sanitization or context-appropriate escaping. Because the injected value lives inside a JavaScript execution context, standard HTML entity encoding would not be sufficient, and the plugin performs no escaping at all.
Exploitation requires contributor-level privileges, which limits opportunistic attacks. However, many WordPress deployments grant contributor accounts to freelance writers, guest bloggers, or automated onboarding flows. Once injected, the payload executes whenever a visitor or administrator loads the affected post or page, giving the attacker JavaScript execution in a trusted origin.
Root Cause
The root cause is missing output encoding when the custom skin setting is emitted inside an inline script tag. WordPress provides context-aware escaping helpers such as esc_js() and wp_json_encode(), but the affected code path does not apply them. This maps to CWE-79, Improper Neutralization of Input During Web Page Generation.
Attack Vector
An authenticated contributor sets a crafted custom skin value containing JavaScript syntax that breaks out of the intended string literal within the inline script. When the post embedding the CoolClock shortcode is viewed, the browser parses and executes the injected script under the site's origin. Refer to the WPScan advisory for additional technical detail. No verified proof-of-concept code is published; the vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-83545
Indicators of Compromise
- Unexpected <script> content or JavaScript string literals inside CoolClock skin configuration values stored in the wp_options or wp_postmeta tables.
- Outbound requests from visitor browsers to unfamiliar domains following page loads containing the CoolClock widget.
- New or modified administrator accounts created shortly after a contributor edits CoolClock settings.
Detection Strategies
- Review CoolClock plugin settings and post metadata for skin values containing characters such as ', ", </script>, or javascript: sequences.
- Inspect rendered HTML of pages hosting the CoolClock widget for inline scripts referencing untrusted domains or obfuscated payloads.
- Correlate contributor account activity with subsequent privilege changes or plugin configuration updates in WordPress audit logs.
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture contributor-level edits to plugin settings and post content.
- Deploy a web application firewall (WAF) with rules covering stored XSS payloads targeting WordPress plugin parameters.
- Monitor Content Security Policy (CSP) violation reports to identify inline script executions that fall outside expected origins.
How to Mitigate CVE-2026-83545
Immediate Actions Required
- Update the CoolClock plugin to version 4.3.8 or later on all WordPress installations.
- Audit existing CoolClock skin settings and remove any values containing script fragments or unexpected characters.
- Review contributor and author accounts, disabling any that are inactive, unrecognized, or created through unverified registration flows.
Patch Information
The vendor addressed the vulnerability in CoolClock version 4.3.8 by adding proper escaping of the custom skin setting before it is emitted inside inline scripts. See the WPScan vulnerability entry for the authoritative fix reference.
Workarounds
- Restrict contributor-level and higher accounts to trusted users until the plugin can be updated.
- Temporarily deactivate the CoolClock plugin on sites that cannot be patched immediately.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS.
# Update CoolClock via WP-CLI
wp plugin update coolclock --version=4.3.8
# Verify installed version
wp plugin get coolclock --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
