WP FullCalendar

WP FullCalendar has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 2 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

2 of the records (50%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

4 independent researchers contributed these findings, one record each. WP FullCalendar is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage50%
Open

2

Fixed

2

Get automatic notifications for all WP FullCalendar vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-22351

FullCalendar <= 1.6 - Missing Authorization

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv1.6
4.7(96)
94/100
Last Updated
2026-05-23 (4mo ago)
Active Installs
8,000+
Downloads
211,418
Requires WP
3.6+
Requires PHP
0+
Tested up to
WP 7.0.4
Created
2012-05-03 (15y ago)

FullCalendar is a free open source jQuery plugin by Adam Arshaw which generates a stunning calendar populated with your events. This plugin combines the power of FullCalendar 3.x and WordPress to present your posts or any other custom post type in a calendar format, which can be filtered by custom taxonomies such as categories and tags. Demo – See it in action Features AJAX powered Month/Week/Day views Style your calendar with dozens of themes or create your own with the jQuery ThemeRoller Filter by taxonomy, such as category, tag etc. Supports custom post types and custom taxonomies Popout/Tooltip post summaries and thumbnails when you hover over your calendar items. Integrates seamlessly with Events Manager Various hooks and filters for added flexibility for developers Credits Big thank you to Michael Lynn who generously gave us this plugin namespace after deciding not to go through with his implementation. One less confusing name on the plugin repo! This plugin was originally created for Events Manager Pro, which has been moved over here so it can be used by the community for other post types. Support and maintenance is sponsored by proceeds from this premium plugin, so if you’re in need of a good Events plugin, give it a try! Roadmap Here’s a rough roadmap of where we’re heading, and will be ammended as time permits Move to FullCalendar 5.x library Remove jQuery dependency (due to 5.x transition and select boxes) Add Gutenberg blocks Add more native FullCalendar options to the settings page Add formats for custom post types (currently only possible with Events Manager) Colors for other taxonomies (currently only possible with Events Manager) Multiple post types on one calendar

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C