Private Google Calendars

Private Google Calendars has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Private Google Calendars has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Private Google Calendars is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Private Google Calendars vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2023-52198

Private Google Calendars <= 20231125 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-11-10 15:11	Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset Private Google Calendars <= 20250811	`CVE-2025-12526`	4.3 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2024-01-03 00:00	Private Google Calendars <= 20231125 - Authenticated (Contributor+) Stored Cross-Site Scripting Private Google Calendars <= 20231125	`CVE-2023-52198`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–2 of 2 reports

Latestv20251206

Private Google Calendars

Author

michielve

4.8(23)

96/100

Last Updated

2025-12-06 (9mo ago)

Active Installs

1,000+

Downloads

54,924

Requires WP

4.6+

Requires PHP

5.4.0+

Tested up to

WP 6.9.7

Created

2017-10-10 (9y ago)

If you update to version 20230111, please note that: The theming has slightly been changed. Now there is distinction between bundled and custom themes. The previously bundled dark and light themes have been renamed. So if you used these themes, you now have to manually update these themes to the new pgc-dark and pgc-light themes. The popup theme has been removed. This can now be set in your custom theme. See for details about this release: https://blog.michielvaneerd.nl/wordpress-plugins/private-google-calendars/version-20230111-details/ This plugin can display multiple private and public Google calendars with a shortcode, Gutenberg block or as a widget. See the webpage for more information. Features Access to private (and public) calendars by using OAuth2 or an API key. Adjustable caching – this can greatly improve the performance. It uses the FullCalendar library to show the calendar and can be fully customized within the Gutenberg block, shorcode attributes and the widget settings. Calendar filtering.

View on WordPress.org