CoolClock

CoolClock has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

Every one of the 3 issues recorded for CoolClock has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Philipp Doblhofer. CoolClock is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all CoolClock vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-83545

CoolClock < 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
CoolClock banner
Latestv4.3.10
4.7(15)
94/100
Last Updated
2026-10-02 (25d ago)
Active Installs
1,000+
Downloads
92,732
Requires WP
5.8+
Requires PHP
5.6+
Tested up to
WP 7.1.3
Created
2012-12-09 (14y ago)

This plugin integrates CoolClock – The Javascript Analog Clock into your WordPress site. You can add it as a widget to your sidebar or insert it into your posts and pages with a shortcode. See the FAQ’s for available shortcode parameters and how to build the clock into your theme. Features Can be added via a widget, shortcode or theme function No flash, meaning compatible with tablets and most other javascript enabled mobile devices 22 different skins to choose from or Custom skin option to create your own skin style Linear or logarithmic time scale Read more on the CoolClock homepage or see the FAQ’s to learn how to configure your own skin settings. Pro features Show date or 24h digital time Background image or color Border radius (rounded corners for background) Advanced positioning options (relative to background) Advanced shortcode parameters (including background image and custom skin) One extra clean skin for use with background image Support on the CoolClock Pro forum Pro features come with the CoolClock – Advanced extension. Privacy / GDPR This plugin does not collect any user or visitor data nor set browser cookies. Using this plugin should not impact your site privacy policy in any way. Known Issues When IE 8 is manually put or forced (through X-UA-Compatibility meta tag or response header) into Compatibility mode, the Clock will –even though the canvas area is put in place– remain invisible. When a shortcode is not placed on its own line but on the same line with text, image or even another shortcode, then the output (div with canvas tag) will be wrapped inside a paragraph tag. While most browsers do not have a problem displaying the clock, this will cause a validation error. Please report any other issues on the Support page.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C