Is CVE-2026-83545 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-83545

Description

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.