Schedule Posts Calendar

Schedule Posts Calendar has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Schedule Posts Calendar has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Schedule Posts Calendar is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Schedule Posts Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2023-40560

Schedule Posts Calendar <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings

Read the full analysis

Vulnerability Records

2 records


2023-08-16 00:00	Schedule Posts Calendar <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings Schedule Posts Calendar <= 5.2	`CVE-2023-40560`	4.4 Medium	Rio Darmawan	Yes
2023-08-16 00:00	Schedule Posts Calendar <= 5.2 - Cross-Site Request Forgery Schedule Posts Calendar <= 5.2	`CVE-2023-40556`	4.3 Medium	Nguyen Xuan Chien	Yes

Showing 1–2 of 2 reports

Latestv5.3

Schedule Posts Calendar

Author

Greg Ross

4.7(10)

94/100

Last Updated

2023-12-03 (3y ago)

Active Installs

1,000+

Downloads

36,804

Requires WP

3.0.0+

Requires PHP

Tested up to

WP 6.4.10

Created

2012-03-02 (15y ago)

Adds a JavaScript calendar to the scheduled publish widget to allow you to select a date and time graphically instead of via the text entry boxes. This plugin uses the gpl’d dhtmlxcalendar (http://dhtmlx.com/docs/products/dhtmlxCalendar/index.shtml) for the calendar control. This code is released under the GPL v2, see license.txt for details. Roadmap None at this time.

View on WordPress.org