WP FullCalendar

WP FullCalendar has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 4 issues recorded for WP FullCalendar has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. WP FullCalendar is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all WP FullCalendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2022-3891

WP FullCalendar <= 1.4.1 - Missing Authorization to Information Disclosure

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv1.6.1
4.7(96)
94/100
Last Updated
2026-09-24 (1mo ago)
Active Installs
8,000+
Downloads
217,716
Requires WP
3.6+
Requires PHP
0+
Tested up to
WP 7.1.3
Created
2012-05-03 (15y ago)

FullCalendar is a free open source jQuery plugin by Adam Arshaw which generates a stunning calendar populated with your events. This plugin combines the power of FullCalendar 3.x and WordPress to present your posts or any other custom post type in a calendar format, which can be filtered by custom taxonomies such as categories and tags. Demo – See it in action Features AJAX powered Month/Week/Day views Style your calendar with dozens of themes or create your own with the jQuery ThemeRoller Filter by taxonomy, such as category, tag etc. Supports custom post types and custom taxonomies Popout/Tooltip post summaries and thumbnails when you hover over your calendar items. Integrates seamlessly with Events Manager Various hooks and filters for added flexibility for developers Credits Big thank you to Michael Lynn who generously gave us this plugin namespace after deciding not to go through with his implementation. One less confusing name on the plugin repo! This plugin was originally created for Events Manager Pro, which has been moved over here so it can be used by the community for other post types. Support and maintenance is sponsored by proceeds from this premium plugin, so if you’re in need of a good Events plugin, give it a try! Roadmap Here’s a rough roadmap of where we’re heading, and will be ammended as time permits Move to FullCalendar 5.x library Remove jQuery dependency (due to 5.x transition and select boxes) Add Gutenberg blocks Add more native FullCalendar options to the settings page Add formats for custom post types (currently only possible with Events Manager) Colors for other taxonomies (currently only possible with Events Manager) Multiple post types on one calendar

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C