Pretty Google Calendar

Pretty Google Calendar has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Missing Authorization.

Every one of the 3 issues recorded for Pretty Google Calendar has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Pretty Google Calendar is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Pretty Google Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-33640

Pretty Google Calendar <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2025-12-19 15:06	Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure Pretty Google Calendar <= 2.0.0	`CVE-2025-12898`	5.3 Medium	Ahmad Salem (a7mad.cc)	Yes
2024-04-25 00:00	Pretty Google Calendar <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Pretty Google Calendar <= 1.7.2	`CVE-2024-33640`	6.4 Medium	LVT-tholv2k	Yes
2023-09-25 00:00	Pretty Google Calendar <= 1.5.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode Pretty Google Calendar < 1.6.0	`N/A`	6.4 Medium	Anonymous	Yes

Showing 1–3 of 3 reports

Plugin Profile

Latestv2.2.1

Pretty Google Calendar

Author

LBell

4.6(20)

92/100

Last Updated

2026-01-04 (8mo ago)

Active Installs

4,000+

Downloads

70,250

Requires WP

3.0+

Requires PHP

Tested up to

WP 6.9.7

Created

2021-10-13 (5y ago)

Plugin Migration Notice Pretty Google Calendar is transitioning to Hydrogen Calendar Embeds. Please install that plugin for future updates and improvements. Why Switch to Hydrogen Calendar Embeds? No more fussing with the Google API — just use simple .ics calendar feeds Display any calendar that provides a public .ics feed (e.g. Google Calendar, Apple Calendar, Outlook, etc.) Works with blocks and shortcodes More features, fewer bugs, and still lightweight 100% FREE Active development and ongoing support Legacy Pretty Google Calendar Features You: I just want to embed a Google Calendar in my WordPress site. Google: Here’s a special kind of ugly! Pretty Google Calendar: I got this. This is a light and simple to use plugin that embeds Google Calendars in your website with style, beauty and grace. Highlights: Out of the box support for calendar grid and agenda list view (and most other FullCalendar views) Responsive design switches to list view on smaller screens List view customizable to day, week, month, year or custom number of days How it works: Continue to manage events using Google Calendar as you’ve always done. Add a shortcode to your page. Sigh with relief. That’s it.

View on WordPress.org