WP FullCalendar Security & Risk Analysis

The wp-fullcalendar plugin v1.6 presents a moderate security risk due to a combination of static analysis findings and a concerning vulnerability history. While the code shows positive signs such as 100% prepared SQL statements and a high percentage of properly escaped output, the presence of two AJAX handlers without authentication checks is a significant concern. This could allow unauthenticated users to trigger potentially harmful actions.

The plugin's vulnerability history is a more substantial red flag, with a total of four known CVEs, two of which remain unpatched. The common vulnerability types including Exposure of Sensitive Information, Cross-site Scripting, and Missing Authorization suggest recurring security weaknesses that have not been fully addressed. The fact that the most recent vulnerability was dated in 2026, albeit a future date, implies a pattern of unresolved security issues that could be exploited.

Overall, while the codebase exhibits some good security practices, the unpatched vulnerabilities and unprotected entry points create a notable risk. Users should proceed with caution and prioritize updating to versions that address these known security flaws. The plugin's strengths in SQL sanitization and output escaping are overshadowed by the historical and present risks.