WPCal.io – Easy Meeting Scheduler Security & Risk Analysis

The wpcal plugin v0.9.5.10 exhibits a mixed security posture. While it demonstrates good practices in its SQL query handling, with a high percentage of prepared statements, and a reasonable number of capability checks, several areas raise significant concerns. The presence of three AJAX handlers without authentication checks creates a substantial attack surface that could be exploited by unauthenticated users. Furthermore, a concerning 75% of output operations are not properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. Taint analysis also revealed three flows with unsanitized paths, though thankfully none reached critical or high severity in this static scan.

The plugin's vulnerability history is also a point of concern, with two known medium-severity CVEs recorded, specifically related to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). The fact that the last vulnerability was recorded relatively recently (December 2025) suggests a recurring pattern of introducing security weaknesses. While there are currently no unpatched CVEs, the history of past vulnerabilities, combined with the identified code signals like unauthenticated AJAX endpoints and insufficient output escaping, paints a picture of a plugin that requires careful attention to security, despite some positive aspects like robust SQL usage.