Intl DateTime Calendar

Intl DateTime Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Intl DateTime Calendar has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Gilang - DJ. Intl DateTime Calendar is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Intl DateTime Calendar vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-8293

Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter

Read the full analysis

Vulnerability Records

1 records
Intl DateTime Calendar banner
Latestv2.0.3

Intl DateTime Calendar

Theerawat Patthawee

Author

Theerawat Patthawee

0.0(0)
0/100
Last Updated
2026-08-29 (15d ago)
Active Installs
10+
Downloads
846
Requires WP
6.5+
Requires PHP
8.1+
Tested up to
WP 7.1
Created
2025-05-12 (1y ago)

Intl DateTime Calendar changes how dates are written on your site without changing what is stored. You pick a calendar. Your posts, archives and comments then show dates the way your readers write them. Every date stays in the database exactly as WordPress saved it. The machine readable date that search engines look for stays untouched. What it does Any calendar system including Buddhist, Hijri, Hebrew, Persian, Japanese, Indian, Coptic, Ethiopic and Chinese Native digits so a Thai site can show ๔ พฤษภาคม ๒๕๖๘ and an Arabic site can show ٦ ذو القعدة ١٤٤٦ Your existing date format is respected, including any custom format set on an individual block Where it counts on post dates, modified dates, comments and archives, and nowhere else. What a plugin stores is never touched Correct for search engines because the underlying datetime attribute stays Gregorian and unambiguous No database changes at all. Switching calendars or removing the plugin leaves your content untouched Dates are written before the page is sent On a host with the PHP intl extension, dates are converted on the server. Readers see the right calendar immediately. There is no flicker as the page loads. Dates remain correct for anyone browsing with JavaScript turned off. Under this setup, the plugin adds no JavaScript to your pages. If your host lacks the intl extension, everything still works. The conversion moves to the browser and a small script is added to each page. Site Health tells you which method your site is using. Supported calendars Gregorian, Buddhist, Chinese, Coptic, Dangi, Ethiopic, Ethiopic Amete Alem, Hebrew, Indian, Islamic, Islamic Civil, Islamic Saudi Arabia, Islamic Tabular, Islamic Umm al-Qura, ISO 8601, Japanese, Persian and Republic of China. Supported digits Every decimal numbering system Unicode defines, which is around 77 of them. The familiar ones are listed first. Western, Arabic Indic, Eastern Arabic Indic, Bengali, Devanagari, Thai, Lao, Myanmar, Tibetan, Gurmukhi, Gujarati, Kannada, Malayalam, Odia, Tamil, Telugu, Sinhala, Khmer, Han decimal and full width. Every other script follows, each shown next to a sample of its digits. Only the systems your server can actually write are offered, so the list matches the version of ICU your host runs. You can also leave this alone and let the site language decide. Privacy This plugin does not collect, store or send any personal data.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C