The TimeZoneCalculator plugin for WordPress is vulnerable to a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of user‑supplied attributes on its "timezonecalculator_output" shortcode. An attacker who can authenticate with contributor‑level or higher access can inject arbitrary JavaScript into pages that, when viewed by other users, will execute in their browsers, potentially allowing data theft, session hijacking, or defacement.

WordPress sites installing the TimeZoneCalculator plugin, versions up to and including 3.37, released by the vendor neoxx.

The flaw carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access with at least contributor privileges, meaning an attacker must first gain legitimate credentials or elevate privileges within the WordPress installation before injecting malicious payloads.