Vulnerabilities

TI-2025-11816 CVE-2025-12898 · GHSA-2p3v-w39c-p52w

Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure

LOW 30

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00275 Published 2025-12-20 No fix listed CWE-862

TI-2024-22224 CVE-2024-33640 · GHSA-mw23-jwm4-23g8

WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0032 Published 2024-04-29 No fix listed CWE-79

Vulnerabilities

Filters

Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure

WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability