CVE-2021-24670: STATUS301 Coolclock

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks

Affected products

• STATUS301 Coolclock: before 4.3.5 (fixed in 4.3.5)

Published 2021-09-27. Last modified 2026-06-17.