Intl DateTime Calendar
Intl DateTime Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Intl DateTime Calendar has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Gilang - DJ. Intl DateTime Calendar is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-8293Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter
Read the full analysisVulnerability Records

Intl DateTime Calendar
Author
Theerawat Patthawee
Intl DateTime Calendar changes how dates are written on your site without changing what is stored. You pick a calendar. Your posts, archives and comments then show dates the way your readers write them. Every date stays in the database exactly as WordPress saved it. The machine readable date that search engines look for stays untouched. What it does Any calendar system including Buddhist, Hijri, Hebrew, Persian, Japanese, Indian, Coptic, Ethiopic and Chinese Native digits so a Thai site can show ๔ พฤษภาคม ๒๕๖๘ and an Arabic site can show ٦ ذو القعدة ١٤٤٦ Your existing date format is respected, including any custom format set on an individual block Where it counts on post dates, modified dates, comments and archives, and nowhere else. What a plugin stores is never touched Correct for search engines because the underlying datetime attribute stays Gregorian and unambiguous No database changes at all. Switching calendars or removing the plugin leaves your content untouched Dates are written before the page is sent On a host with the PHP intl extension, dates are converted on the server. Readers see the right calendar immediately. There is no flicker as the page loads. Dates remain correct for anyone browsing with JavaScript turned off. Under this setup, the plugin adds no JavaScript to your pages. If your host lacks the intl extension, everything still works. The conversion moves to the browser and a small script is added to each page. Site Health tells you which method your site is using. Supported calendars Gregorian, Buddhist, Chinese, Coptic, Dangi, Ethiopic, Ethiopic Amete Alem, Hebrew, Indian, Islamic, Islamic Civil, Islamic Saudi Arabia, Islamic Tabular, Islamic Umm al-Qura, ISO 8601, Japanese, Persian and Republic of China. Supported digits Every decimal numbering system Unicode defines, which is around 77 of them. The familiar ones are listed first. Western, Arabic Indic, Eastern Arabic Indic, Bengali, Devanagari, Thai, Lao, Myanmar, Tibetan, Gurmukhi, Gujarati, Kannada, Malayalam, Odia, Tamil, Telugu, Sinhala, Khmer, Han decimal and full width. Every other script follows, each shown next to a sample of its digits. Only the systems your server can actually write are offered, so the list matches the version of ICU your host runs. You can also leave this alone and let the site language decide. Privacy This plugin does not collect, store or send any personal data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C