Simple Calendar – Google Calendar Plugin

Simple Calendar – Google Calendar Plugin has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2025; all 7 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 3 of the records (43%). Other recurring categories include Cross-Site Scripting, Authorization Bypass Through User-Controlled Key.

Every one of the 7 issues recorded for Simple Calendar – Google Calendar Plugin has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Simple Calendar – Google Calendar Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2023-49151

Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Read the full analysis

Vulnerability Records

7 records


2025-12-18 00:00	Google Calendar Events <= 3.5.9 - Unauthenticated Insecure Direct Object Reference Simple Calendar <= 3.5.9	`CVE-2025-68979`	5.3 Medium	Doan Dinh Van (d52v)	Yes
2024-09-24 12:31	Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting Simple Calendar <= 3.4.2	`CVE-2024-8549`	6.1 Medium	vgo0	Yes
2023-11-28 00:00	Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Simple Calendar <= 3.2.7	`CVE-2023-49151`	6.4 Medium	Abdi Pranata	Yes
2023-10-20 00:00	Simple Calendar <= 3.2.4 - Cross-Site Request Forgery via duplicate_feed Simple Calendar < 3.2.5	`N/A`	4.3 Medium	Anonymous	Yes
2023-10-18 00:00	Google Calendar Events <= 3.2.5 - Cross-Site Request Forgery via bulk_actions Simple Calendar <= 3.2.5	`CVE-2023-46189`	4.3 Medium	Nguyen Xuan Chien	Yes
2023-05-11 00:00	Simple Calendar <= 3.1.42 - Cross-Site Request Forgery to Transient Cache Clearing Simple Calendar <= 3.1.42	`N/A`	4.3 Medium	Anonymous	Yes
2014-10-08 00:00	Simple Calendar – Google Calendar Plugin < 2.0.4 - Reflected Cross-Site Scripting Simple Calendar < 2.0.4	`CVE-2014-7138`	6.1 Medium	High-Tech Bridge Security Research Lab	Yes

Showing 1–7 of 7 reports