CVE-2025-5559: 
WordPress vulnerability analysis and mitigation

The TimeZoneCalculator plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-5559) affecting all versions up to and including 3.37. The vulnerability was discovered and reported on June 25, 2025, and exists in the plugin's 'timezonecalculator_output' shortcode due to insufficient input sanitization and output escaping on user supplied attributes (NVD, Wiz).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 6.4 (Medium). The vulnerability specifically affects the plugin's 'timezonecalculator_output' shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allows for script injection. The attack requires authentication with contributor-level access or higher privileges (NVD).

When successfully exploited, this vulnerability enables authenticated attackers to inject malicious web scripts that execute in users' browsers when they visit affected pages. The potential consequences include theft of sensitive information, session hijacking, and other malicious actions performed in the context of the victim's browser (Wiz).

The plugin has been temporarily closed as of June 19, 2025, pending a full security review. Users are advised to disable or remove the plugin until a security fix is available (WordPress Plugin).