CVE-2026-83546: CoolClock WordPress Plugin XSS Vulnerability

CVE-2026-83546 Overview

CVE-2026-83546 is a stored Cross-Site Scripting (XSS) vulnerability in the CoolClock WordPress plugin before version 4.3.8. The plugin fails to properly escape a skin setting before rendering it inside an HTML attribute. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected content. The issue is tracked under [CWE-79] and was published on 2026-09-11.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that runs in the browsers of site visitors and administrators, enabling session theft, privilege escalation via administrator actions, and site defacement.

Affected Products

CoolClock WordPress plugin versions prior to 4.3.8
WordPress sites allowing contributor-level (or higher) user registration
Any WordPress installation embedding CoolClock shortcodes in published content

Discovery Timeline

2026-09-11 - CVE-2026-83546 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-83546

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the CoolClock plugin's skin configuration handling. CoolClock renders analog clock widgets in WordPress posts and pages using a shortcode that accepts a skin parameter. The plugin writes the user-supplied skin value directly into an HTML attribute of the generated clock markup without applying attribute-context escaping.

Because WordPress contributors can author draft posts containing shortcodes, a low-privileged user can embed a shortcode where the skin attribute breaks out of its quoted context and injects arbitrary HTML event handlers or <script> payloads. The payload is stored in the post content and executes whenever the post is rendered, including in editorial preview by administrators.

Exploitation requires user interaction, because a higher-privileged user must view the post containing the malicious shortcode. Successful exploitation runs script in the victim's browser under the WordPress site origin.

Root Cause

The root cause is missing output escaping. The plugin does not apply esc_attr() to the skin setting before concatenating it into an HTML attribute value. WordPress provides context-specific escaping helpers precisely to prevent this class of injection, and CoolClock omits the attribute-context escape on this parameter.

Attack Vector

An authenticated attacker with the contributor role authors a post that includes a CoolClock shortcode. The skin attribute is set to a payload that terminates the surrounding attribute quote and appends a JavaScript event handler such as onerror or onmouseover. When an editor or administrator previews or publishes the post, the injected script executes with the privileges of the viewing session. See the WPScan Vulnerability Advisory for advisory details.

Detection Methods for CVE-2026-83546

Indicators of Compromise

Post or page content containing CoolClock shortcodes with unusual characters in the skin attribute, such as quotes, angle brackets, or on* event handler names.
Draft or pending posts authored by contributor accounts that embed CoolClock shortcodes referencing external script sources.
Unexpected outbound requests from browsers rendering WordPress pages to attacker-controlled domains.

Detection Strategies

Query the wp_posts table for shortcodes matching [coolclock combined with attribute values containing ", <, >, or on[a-z]+=.
Review web server logs for administrator sessions loading posts authored by contributor accounts immediately followed by requests to unknown domains.
Deploy a Web Application Firewall (WAF) rule to flag stored payloads containing script-related keywords in plugin shortcode parameters.

Monitoring Recommendations

Audit contributor and author accounts for recent post submissions containing CoolClock shortcodes.
Monitor plugin version inventory across WordPress installations to identify hosts running CoolClock below 4.3.8.
Alert on Content Security Policy (CSP) violation reports originating from pages that embed CoolClock widgets.

How to Mitigate CVE-2026-83546

Immediate Actions Required

Upgrade the CoolClock plugin to version 4.3.8 or later on all WordPress sites.
Audit existing posts and pages for CoolClock shortcodes with suspicious skin values and sanitize or remove them.
Review and, where possible, restrict the contributor role for untrusted users until patching is complete.

Patch Information

The vendor addressed the flaw in CoolClock version 4.3.8 by applying proper attribute-context escaping to the skin setting. Update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Refer to the WPScan Vulnerability Advisory for the fixed version reference.

Workarounds

Deactivate the CoolClock plugin until the update to 4.3.8 can be applied.
Remove or downgrade untrusted contributor-level accounts on sites that rely on the plugin.
Enforce a strict Content Security Policy that disallows inline scripts and unknown script origins to reduce the impact of stored XSS payloads.

bash

# Update CoolClock to the patched release using WP-CLI
wp plugin update coolclock --version=4.3.8

# Verify installed version across sites
wp plugin get coolclock --field=version