Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: CoolClock 4.3.8 Clear all filters
TI-2026-57682 CVE-2026-83546 · GHSA-mvvr-5rcc-xqpx

CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

Priority LOW 30

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts th…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-09-11 Fixed in 4.3.8 CWE-79
TI-2026-57681 CVE-2026-83545 · GHSA-rp7h-v4qm-gcfw

CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

Priority LOW 30

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScri…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-09-11 Fixed in 4.3.8 CWE-79