UseStrict’s Calendly Embedder

UseStrict’s Calendly Embedder has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for UseStrict’s Calendly Embedder has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nabil Irawan. UseStrict’s Calendly Embedder is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all UseStrict’s Calendly Embedder vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-67555

UseStrict's Calendly Embedder <= 1.1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
UseStrict’s Calendly Embedder banner
Latestv1.2.3

UseStrict’s Calendly Embedder

Vinny

Author

Vinny

5.0(3)
100/100
Last Updated
2026-10-21 (7d ago)
Active Installs
2,000+
Downloads
32,239
Requires WP
4.5+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2021-08-19 (5y ago)

Embed Calendly on any WordPress page with a shortcode you build by pointing and clicking, instead of hand-writing Calendly’s embed code. What the free plugin does Three embed types. Inline calendar, pop-up text link, or the floating pop-up widget (badge), each with its own options. Connect your Calendly account with a Personal Access Token and pick your profile page or any event type from a dropdown. No copying URLs around. Without a token, paste the Calendly URL instead. Caching-safe prefill. Fill the booking form with the logged-in user’s name and email, or with values from the query string. The prefill runs in the browser through AJAX after the page loads, so it keeps working behind full-page caches and CDNs, where server-side prefill can serve one visitor’s details to the next. Up to ten custom answers, prefilled the same way. Match your site. Background, text and button colours, minimum width and height, extra CSS classes and inline styles. Hide what you do not need. The GDPR cookie banner, landing page details and event type details. Shortcode builder under Settings. Choose the options, copy the generated shortcode, paste it into any page, post, widget or page builder that runs shortcodes. The builder generates a shortcode; it does not store it. To change an embed later, edit the shortcode where you pasted it, or build a new one. Going further: Calendly Embedder Pro Pro picks up where the free plugin stops, and your existing embeds come with you: Pro finds the shortcodes already in your posts and pages and pulls them into a library, so upgrading is not a rebuild. A shortcode library. Save each embed once, reuse it anywhere, edit it in one place and every page updates. Place it with a shortcode, the Calendly Embed block, or the Elementor widget. Booking analytics on your own site. The funnel from profile view to completed booking, plus kept, no-show and cancelled outcomes by month. Ask your AI assistant. A read-only MCP server lets Claude, ChatGPT or Cursor query your booking data live. No extra API key; it uses the Calendly connection you already have. “What was my no-show rate in September?” is one question. Campaign tagging. Tag any embed with UTM parameters — source, medium, campaign, content and term — globally or per embed. These are standard UTM tags, so whichever analytics you run reads them, and Calendly records them against the booking as well. Conversion tracking. GA4 and Meta Pixel events on every completed booking, through the tags already on your site. Lead capture. Posts each new booking to any webhook URL: Zapier, Make, n8n, or a HubSpot workflow. More ways to book. Multi-event tabs, live availability next to the embed, email reminders, a bookings screen in wp-admin, WooCommerce integration, a redirect after booking, and a CSV export of your tracking data. Pro runs alongside the free plugin, and your existing shortcodes keep working.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C