Coolclock
Monthly
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.