CoolClock WordPress plugin improperly escapes a custom skin setting before embedding it inside an inline script, allowing users with contributor‑level access or higher to inject arbitrary JavaScript that executes when a page is viewed. This stored cross‑site scripting flaw permits malicious code to persist in the site and run in the browsers of all users who view the affected content.

The vulnerability affects all installations of the CoolClock plugin on WordPress sites that permit custom skin configuration, for any version other vendors or products are listed.

Exploitation requires an authenticated account with contributor‑level access or higher. Once injected, the malicious script is stored within the custom skin configuration and will execute every time a visitor loads a page that includes the affected skin. The CVSS base score is 6.8, and the vulnerability is not listed in KEV. Because the stored JavaScript can run in the browsers of all visitors, the potential impact is significant if the site is publicly accessible.