Skedmaker Security & Risk Analysis

wordpress.org/plugins/skedmaker-online-scheduling

Skedmaker is an online appointment booking system that lets your clients make a reservation with you via the internet, 24/7/365.

10 active installs v0.98 PHP + WP 3.0.1+ Updated Feb 1, 2016
appointmentsbookingdatebookplannerscheduling-online
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Skedmaker Safe to Use in 2026?

Generally Safe

Score 85/100

Skedmaker has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 10yr ago
Risk Assessment

The skedmaker-online-scheduling plugin v0.98 exhibits a mixed security posture. While the static analysis reports no known CVEs and a limited attack surface with no identified unprotected entry points, significant concerns arise from the code analysis. The most alarming finding is that 100% of outputs are not properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Additionally, despite a relatively high percentage of SQL queries using prepared statements, the presence of 33 SQL queries suggests potential for SQL injection if the unescaped outputs or other unaddressed code flows can influence query parameters. The taint analysis, while not flagging critical or high severity issues, reveals that all analyzed flows involve unsanitized paths, which, when combined with unescaped output, could lead to severe vulnerabilities.

Key Concerns

  • 100% of output escaping missing
  • All taint flows involve unsanitized paths
  • 0 nonce checks present
  • 0 capability checks present
  • SQL queries present without clear sanitization context
Vulnerabilities
None known

Skedmaker Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

Skedmaker Code Analysis

Dangerous Functions
0
Raw SQL Queries
13
20 prepared
Unescaped Output
729
0 escaped
Nonce Checks
0
Capability Checks
0
File Operations
3
External Requests
0
Bundled Libraries
0

SQL Query Safety

61% prepared33 total queries

Output Escaping

0% escaped729 total outputs
Data Flows
32 unsanitized

Data Flow Analysis

25 flows32 with unsanitized paths
<_appointments> (_admin\_appointments.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Skedmaker Attack Surface

Entry Points1
Unprotected0

Shortcodes 1

[wp-skedmaker] wp-skedmaker.php:89
WordPress Hooks 5
actionactivated_pluginwp-skedmaker.php:27
actionadmin_menuwp-skedmaker.php:39
actionwp_enqueue_scriptswp-skedmaker.php:69
actioninitwp-skedmaker.php:77
actionadmin_enqueue_scriptswp-skedmaker.php:81
Maintenance & Trust

Skedmaker Maintenance & Trust

Maintenance Signals

WordPress version tested4.4.34
Last updatedFeb 1, 2016
PHP min version
Downloads6K

Community Trust

Rating92/100
Number of ratings9
Active installs10
Developer Profile

Skedmaker Developer Profile

theArab

2 plugins · 20 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Skedmaker

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/skedmaker-online-scheduling/_include/sm-styles.php/wp-content/plugins/skedmaker-online-scheduling/_btns/btn_reminders32_reg.png/wp-content/plugins/skedmaker-online-scheduling/_btns/btn_chair32_reg.png/wp-content/plugins/skedmaker-online-scheduling/_btns/btn_future32_reg.png

HTML / DOM Fingerprints

HTML Comments
<!-- Coding and decoding --><!-- Start session if not already started --><!-- shortcode --><!-- dashboard panel -->
Data Attributes
data-iddata-actiondata-namedata-servicedata-userdata-date+7 more
JS Globals
SM_dSM_eSM_dcontentSM_logoutSM_redBoxSM_redirect+12 more
Shortcode Output
[wp-skedmaker]
FAQ

Frequently Asked Questions about Skedmaker