UseStrict's Calendly Embedder
UseStrict's Calendly Embedder has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for UseStrict's Calendly Embedder has a vendor fix available, so running the current release closes it.
All of these findings were reported by Nabil Irawan. UseStrict's Calendly Embedder is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-67555UseStrict's Calendly Embedder <= 1.1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
UseStrict's Calendly Embedder
Author
Vinny
Easily embed Calendly widgets onto your pages, with the ability to prefill the fields from the database or query strings. Prefilling is done via Javascript and Ajax, so it is caching-safe. Use the configurator in the settings to generate the shortcode with all supported parameters. Check out the Pro version for the following: Save your shortcodes in a library for ease of use; Embed using a Gutenberg block; Embed using an Elementor widget; Setting Google Analytics variables (Campaign, Source, Medium, Content and Term) Tracking interaction such as Profile page was viewed Event type page was viewed Invitee selected date and time Invitee successfully booked a meeting
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C