Skip to content
PluginCanary

My Calendar

by Joe Dolson · 20,000+ active installs · Checked 5 Nov 2026
Healthy

Healthy: released yesterday, tested with WordPress 7.1, no open vulnerabilities.

82/ 100Healthy
Canary Score

Based on all 5 areas

Sub-scores for My Calendar
Ownership100
Maintenance100
Security60
Support62
Reputation85

How the score works

Active signals

Open issues right now, with links to the source.

  • InfoSEC-39 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 23 past vulnerabilities, all patched. Patched issues are listed in the Security record, not here.

Quick answers

Is My Calendar still maintained?
Yes. Last release 3 Nov 2026, 59 releases in the last 24 months. 3 Nov 2026 · wordpress.org
Who owns My Calendar, and has it changed hands?
No change recorded. Main committer joedolson since Apr 2010. 5 Nov 2026 · SVN log
Was My Calendar removed from wordpress.org?
No. Listed on wordpress.org as of 5 Nov 2026. 5 Nov 2026 · wordpress.org
Is My Calendar safe?
23 known vulnerabilities, all fixed (latest in 3.4.25). Not on the exploited list. 15 Oct 2026 · Wordfence Intelligence
Is the latest My Calendar update safe to install?
No ownership change before 3.8.12. No one-star spike after it. 3 Nov 2026 · Release history

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
joedolson5 Apr 2010 to 3 Nov 2026, 837 commits

1 committer recorded. No ownership changes recorded since 2010.

Maintenance

Last release
yesterday
Releases, 24 months
59
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for My Calendar
Q1 20241
Q2 20248
Q3 20248
Q4 20245
Q1 20250
Q2 20255
Q3 20258
Q4 20253
Q1 20265
Q2 20269
Q3 20268
Q4 202618

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

Resolved, last 2 months
62%
Threads, last 2 months
21

Trend appears after 8 weekly snapshots.

Security record

9 vulnerabilities in 24 months (23 on record), all patched (latest fixed in 3.4.25).

Show 23 patched vulnerabilities
DateIssueCVSSAffectedFixed inDays to patch
15 Oct 2026Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute9.8<= 3.4.24, 3.5 to 3.5.21, 3.6 to 3.6.17, 3.7 to 3.7.17, 3.8 to 3.8.73.4.25Before disclosure
8 Sep 2026Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute6.4<= 3.8.33.8.412
8 Sep 2026Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes6.4<= 3.8.33.8.412
7 Jul 2026Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters7.5<= 3.7.83.7.9Before disclosure
1 Jul 2026Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter5.3<= 3.7.143.7.159
13 May 2026Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter4.3<= 3.7.93.7.108
16 Apr 2026Unauthenticated Denial of Service5.3< 3.7.73.7.711
3 Mar 2026Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4<= 3.7.33.7.41
15 Dec 2025Missing Authorization4.3<= 3.6.163.6.17308
11 Feb 2024Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 3.4.233.4.24981
11 Feb 2024Authenticated (Admin+) Stored Cross-Site Scripting via Events4.4<= 3.4.233.4.24981
26 Nov 2023Unauthenticated SQL Injection9.8<= 3.4.213.4.2278
20 Jan 2023Cross-Site Request Forgery8.8<= 3.4.33.4.417
3 Jan 2023Cross-Site Request Forgery7.1<= 3.3.24.13.3.25Before disclosure
2 Aug 2022Open Redirect4.7<= 3.3.163.3.1721
18 Jul 2022Administrator+ Stored Cross-Site Scripting5.5<= 3.3.163.3.1736
1 Nov 2021Subscriber+ Reflected Cross-Site Scripting5.4<= 3.2.173.2.1843
30 Apr 2019Unauthenticated Cross-Site Scripting6.1<= 3.1.93.1.108
4 Apr 2018Authenticated Stored Cross-Site Scripting6.4< 2.5.172.5.17287
15 May 2015Path Traversal to Remote Code Execution9.8<= 2.3.292.3.30377
15 May 2015Reflected Cross-Site Scripting6.1< 2.3.302.3.30377
20 Apr 2015Reflected Cross-Site Scripting6.1< 2.3.102.3.10415
18 Jan 2012Cross-Site Scripting6.1< 1.10.51.10.5n/a

Changelog mentions of security fixes: 3.7.8 (security, vulnerability); 3.7.10 (security, authorization); 3.7.16 (security); 3.8.0 (nonce); 3.8.4 (security, sanitize).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Reputation

Last 90 days: 5.0 (1 review). Lifetime: 4.7.

Last 90 days vs lifetime average rating for My Calendar
Last 90 days5.0
Lifetime4.7
Average rating per quarter
Average rating per quarter for My Calendar
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q3 20245.0
Q4 20245.0
Q3 20255.0
Q4 20253.7
Q2 20263.7
Q3 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q3 2026.

Rating distribution
5 star141
4 star5
3 star3
2 star4
1 star6
Latest low reviews

Momentum

Active installs
20,000+
Downloads, last full week
13,107
Weekly downloads, last 26 complete weeks
Weekly downloads for My Calendar
4 May 20266,036
11 May 20267,483
18 May 202631,707
25 May 202612,807
1 Jun 20262,562
8 Jun 20261,662
15 Jun 202612,190
22 Jun 20261,743
29 Jun 202611,522
6 Jul 202612,842
13 Jul 20263,847
20 Jul 20261,975
27 Jul 20261,385
3 Aug 20261,289
10 Aug 2026984
17 Aug 202613,876
24 Aug 202622,443
31 Aug 202622,392
7 Sep 20263,343
14 Sep 202614,033
21 Sep 202613,491
28 Sep 202612,528
5 Oct 20263,746
12 Oct 20264,832
19 Oct 202626,544
26 Oct 202613,107

Weekly downloads over the last 4 weeks are 20% above the 26-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

WP Events ManagerScore 95 · 30,000+Events Shortcodes For The EventsScore 95 · 10,000+ICS CalendarScore 95 · 10,000+

Facts

Full name
My Calendar - Accessible Event Manager
Version
3.8.12
Author
Joe Dolson
Added
5 Apr 2010
Last updated
3 Nov 2026
Active installs
20,000+
Requires WordPress
6.5
Tested up to
7.1.4
Requires PHP
7.4
Category
E-commerce & Shopping
Tags
venue, location, accessibility, event manager, event calendar

Other plugins by this author: WP Accessibility, XPoster, Contact Form 7, My Tickets, Able Player, accessible HTML5 media

Questions about My Calendar

Is My Calendar still maintained?

Yes. Last release 3 Nov 2026, 59 releases in the last 24 months.

Who owns My Calendar, and has it changed hands?

No change recorded. Main committer joedolson since Apr 2010.

Was My Calendar removed from wordpress.org?

No. Listed on wordpress.org as of 5 Nov 2026.

Is My Calendar safe?

23 known vulnerabilities, all fixed (latest in 3.4.25). Not on the exploited list.

Is the latest My Calendar update safe to install?

No ownership change before 3.8.12. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 5 Nov 2026.Report a data issue