Cal.com
Cal.com has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Cal.com has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Cal.com is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-31604Cal.com <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Cal.com
Author
Cal.com
Cal.com is an open-source alternative to Calendly that allows easy appointment booking and meeting scheduling without back-and-forth emails. This plugin enables you to: Embed your Cal.com booking calendar inline, as a popup, or as a floating widget. Customize UI with theme colors, layout, and event details visibility. Pre-fill user information and add UTM tracking parameters. Use the new admin widget customizer for styling your calendar with real-time previews. Trigger a Cal.com scheduling button directly inside contact form confirmation screens, LMS instructors profile, WooCommerce and membership profiles. Available integrations: Contact Form 7, Fluent Forms, WPForms, Learn Press, Tutor LMS, Ultimate Member, UsersWP, and WooCommerce. Watch Demo Profile Integrations The plugin supports per-user Cal.com booking URLs on the following platforms: Tutor LMS: Booking button appears on instructor profile pages. LearnPress: Booking button appears on single instructor pages. Ultimate Member: Booking button appears on member profile pages. UsersWP: Booking button appears on member profile pages. To configure: Go to Users → All Users in the WordPress admin. Edit any user (instructor or member). Scroll to the “Cal.com Booking” section. Enter the Cal.com booking URL (e.g., https://cal.com/example/consultation). Update the user. Contact Form 7, Fluent Forms, WPForms Integration Trigger a Cal.com scheduling button directly inside contact form confirmation screens. To configure: Go to Cal.com > Integrations and enable the Contact Form 7 integration. Configure your Cal.com event URL (e.g., https://cal.com/example/30min). When a visitor submits a form successfully, a scheduling prompt with a “Schedule a call instead” button will appear below the form, opening your Cal.com event in a modal popup. WooCommerce Integration Display a Cal.com scheduling prompt in order thank-you pages. To configure: Go to Cal.com > Integrations and enable the WooCommerce integration. Go to Products > All Products > Edit or Products > Add New Products and configure your Cal.com event URL (e.g., https://cal.com/example/30min) per product. After a successful product purchase, a scheduling section will appear in the order thank-you page. Shortcodes [cal url=”/username/meetingid” type=1] Embed inline calendar. [cal url=”/username/meetingid” type=2 text=”Schedule a call”] Embed popup trigger button. [cal_custom url=”/demo/30min” type=1 prefill=”true” utm=”source:localhost” ui='{“theme”:”dark”,”cssVarsPerTheme”:{“dark”:{“cal-brand”:”#a3ffcb”}},”hideEventTypeDetails”:true,”layout”:”week_view”}’ config='{“layout”:”week_view”,”useSlotsViewOnSmallScreen”:true,”disableMobileScroll”:true}’] Embed customizable widget with full UI control, prefill, and UTM support. Shortcode Attributes url: URL of the booking calendar. type: Embed type (1 = inline, 2 = popup, 3 = floating button for [cal_custom]). text: Button text for popup embeds. prefill: Set to true to prefill user info if available. utm: Comma-separated UTM tracking parameters (e.g., source:newsletter, medium:email). ui: JSON object for theme, layout, and visibility customization. config: JSON object for advanced widget configuration (slots view, scrolling, etc.). CSS Customization Customize popup/button text via CSS targeting #calcom-embed-link: #calcom-embed-link, .calcom-embed-link { background-color: #222222; padding: 15px; color: #fff; font-size: 16px; text-align: center; cursor: pointer; }<h3>Use of 3rd Party Software</h3> This plugin relies on Cal.com embed. See their Privacy Policy and Terms of use. Use Cases The plugin can be used to add Cal.com scheduling to many types of WordPress websites, including: Appointment booking websites Consultant and coaching websites Freelancer websites Agency websites Business websites Sales and discovery calls Customer consultations Online courses and instructors Member profiles Personal websites Service businesses Contact and lead-generation forms
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C