Cal.com

Cal.com has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Cal.com has a vendor fix available, so running the current release closes it.

All of these findings were reported by Peter Thaleikis. Cal.com is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Cal.com vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-31604

Cal.com <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Cal.com banner
Latestv2.1.0
3.0(2)
60/100
Last Updated
2026-04-06 (5mo ago)
Active Installs
1,000+
Downloads
12,910
Requires WP
4.6+
Requires PHP
7.4+
Tested up to
WP 6.9.7
Created
2022-11-15 (4y ago)

Cal.com is an open-source alternative to Calendly that allows easy appointment booking and meeting scheduling. This plugin enables you to: Embed your Cal.com booking calendar inline, as a popup, or as a floating widget. Customize UI with theme colors, layout, and event details visibility. Pre-fill user information and add UTM tracking parameters. Use the new admin widget customizer for real-time previews. Watch Demo Shortcodes [cal url=”/username/meetingid” type=1] Embed inline calendar. [cal url=”/username/meetingid” type=2 text=”Schedule a call”] Embed popup trigger button. [cal_custom url=”/demo/30min” type=1 prefill=”true” utm=”source:localhost” ui='{“theme”:”dark”,”cssVarsPerTheme”:{“dark”:{“cal-brand”:”#a3ffcb”}},”hideEventTypeDetails”:true,”layout”:”week_view”}’ config='{“layout”:”week_view”,”useSlotsViewOnSmallScreen”:true,”disableMobileScroll”:true}’] Embed customizable widget with full UI control, prefill, and UTM support. Shortcode Attributes url: URL of the booking calendar. type: Embed type (1 = inline, 2 = popup, 3 = floating button for [cal_custom]). text: Button text for popup embeds. prefill: Set to true to prefill user info if available. utm: Comma-separated UTM tracking parameters (e.g., source:newsletter, medium:email). ui: JSON object for theme, layout, and visibility customization. config: JSON object for advanced widget configuration (slots view, scrolling, etc.). CSS Customization Customize popup/button text via CSS targeting #calcom-embed-link: #calcom-embed-link, .calcom-embed-link { background-color: #222222; padding: 15px; color: #fff; font-size: 16px; text-align: center; cursor: pointer; } Use of 3rd Party Software This plugin relies on Cal.com embed. See their Privacy Policy and Terms of use.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C