Simple Calendar – Google Calendar Plugin Security & Risk Analysis

The 'google-calendar-events' plugin v3.6.2 exhibits a mixed security posture. While it demonstrates a good number of capability checks and nonce checks, indicating an awareness of common WordPress security practices, several areas raise significant concerns. The presence of one unprotected AJAX handler is a critical vulnerability that could allow unauthorized actions. Furthermore, the code analysis reveals the use of the dangerous `unserialize` function, which, if exposed to user-controlled input, can lead to Remote Code Execution (RCE). The fact that all SQL queries are not using prepared statements is another substantial risk, increasing the likelihood of SQL injection vulnerabilities. Taint analysis, while showing no critical or high severity flows, did identify flows with unsanitized paths, suggesting a potential for issues if not handled carefully.

The vulnerability history of this plugin is concerning. With 7 total known CVEs, all categorized as medium severity, it suggests a recurring pattern of security weaknesses, particularly related to Authorization Bypass Through User-Controlled Key, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF). Although there are currently no unpatched CVEs, the consistent discovery of vulnerabilities indicates that the development team may struggle with consistently implementing secure coding practices. The last vulnerability was recorded on 2025-12-18, which is unusual for a historical record and might be a data anomaly. Overall, while some security mechanisms are in place, the identified unprotected entry points, dangerous functions, raw SQL queries, and a history of medium-severity vulnerabilities necessitate caution.