ICS Calendar
ICS Calendar has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Path Traversal.
Every one of the 4 issues recorded for ICS Calendar has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (2) reported by Muhammad Daffa. ICS Calendar is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-46784ICS Calendar <= 10.12.0.2 - Authenticated (Contributor+) Arbitrary File Read and Server-Side Request Forgery
Read the full analysisVulnerability Records
ICS Calendar
Author
Room 34 Creative Services, LLC
Add the calendar you already use to any WordPress site! Google Calendar, Microsoft 365, iCloud, Airbnb and more… no API keys or complicated setup required. Using a simple shortcode, you can turn any iCalendar subscription (ICS) feed (Google Calendar, Microsoft Office 365, Apple iCloud, Airbnb, Vrbo, and many more) into a seamlessly integrated, auto-updating, zero-maintenance WordPress calendar. Continue to manage your events in the calendar software you’re already using! You’ll automatically have an up-to-date calendar in your WordPress website with no extra work. Display your calendar in month, list or week view. Many additional customization options are available. See our User Guide for full details. No API keys required! Works with ANY calendar software that generates a public iCalendar subscription link. Live Preview You can preview your own calendar in any ICS Calendar view at our website: icscalendar.com/preview Shortcode Builder We’ve made it easier than ever to get started using ICS Calendar with our new online shortcode builder: icscalendar.com/shortcode-builder Language Support All date strings (days of the week, months, etc.) are automatically translated into your site’s configured language (under Settings > General > Language) and date/time formats using core WordPress functionality. All text content for the calendar itself is displayed as-is from the feed. ICS Calendar includes built-in translation files for the following languages: Chinese, Czech, Danish, Dutch, Estonian, Finnish, French, German, Greek, Hungarian, Icelandic, Italian, Japanese, Korean, Latvian, Lithuanian, Norwegian, Polish, Portuguese, Romanian, Russian, Serbian, Slovakian, Slovenian, Spanish, Swedish, Turkish, and Ukrainian. Please contact us if you would like us to add support for your language! This plugin includes the PHP ICS Parser library by Jonathan Goode, John Grogg and Martin Thoma (MIT license).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C