Skip to content
PluginCanary

Spiffy Calendar

by Spiffy Plugins · 2,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: maintained, last release 17 Apr 2026, 13 releases in 24 months, no unpatched vulnerabilities.

Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4.

80/ 100 Canary Score
Sub-scores for Spiffy Calendar
Ownership100
Maintenance55
Security90
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Spiffy Calendar still maintained?
Yes. Last release 17 Apr 2026, 13 releases in the last 24 months. 17 Apr 2026 · wordpress.org
Who owns Spiffy Calendar, and has it changed hands?
No change recorded. Main committer spiffyplugins since Nov 2017. 3 Nov 2026 · SVN log
Was Spiffy Calendar removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Spiffy Calendar safe?
15 known vulnerabilities, all fixed (latest in 5.0.9). Not on the exploited list. 28 Aug 2026 · Wordfence Intelligence
Is the latest Spiffy Calendar update safe to install?
No ownership change before 5.0.11. No one-star spike after it. 17 Apr 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
spiffyplugins15 Nov 2017 to 17 Apr 2026, 202 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
7 months ago
Releases, 24 months
13
Tested up to
6.9 vs 7.1
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Spiffy Calendar
Q1 20245
Q2 20240
Q3 20244
Q4 20240
Q1 20257
Q2 20251
Q3 20250
Q4 20252
Q1 20260
Q2 20263
Q3 20260
Q4 20260

Last release 17 Apr 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.9.

Rating distribution
5 star34
4 star4
3 star0
2 star0
1 star0

Security record

2 vulnerabilities in 24 months (15 on record), all patched (latest fixed in 5.0.9).

Show 15 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
28 Aug 2026Spiffy Calendar <= 5.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 5.0.85.0.9Patched before disclosure
5 Jan 2026Spiffy Calendar <= 5.0.7 - Missing Authorization4.3<= 5.0.75.0.8Patched before disclosure
12 Sep 2024Spiffy Calendar <= 4.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.9.134.9.14Patched before disclosure
12 Sep 2024Spiffy Calendar <= 4.9.13 - Reflected Cross-Site Scripting6.1<= 4.9.134.9.14Patched before disclosure
28 Aug 2024Spiffy Calendar <= 4.9.12 - Authenticated (Admin+) SQL Injection4.9<= 4.9.124.9.13Patched before disclosure
10 Jul 2024Spiffy Calendar <= 4.9.11 - Authenticated (Administrator+) SQL Injection9.1<= 4.9.114.9.12Patched before disclosure
29 Mar 2024Spiffy Calendar <= 4.9.10 - Missing Authorization4.3<= 4.9.104.9.11Patched before disclosure
28 Mar 2024Spiffy Calendar <= 4.9.7 - Reflected Cross-Site Scripting6.1<= 4.9.74.9.10Patched before disclosure
12 Jan 2024Spiffy Calendar <= 4.9.8 - Insufficient Authorization4.3<= 4.9.84.9.914
1 Dec 2023Spiffy Calendar <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.9.54.9.6Patched before disclosure
3 May 2023Spiffy Calendar <= 4.9.3 - Reflected Cross-Site Scripting via page parameter4.7< 4.9.44.9.41
16 Dec 2022Spiffy Calendar <= 4.9.1 - Authenticated (Contributor+) SQL Injection8.8<= 4.9.14.9.2Patched before disclosure
10 Feb 2022Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR6.3<= 4.9.04.9.1n/a
10 Feb 2022Spiffy Calendar <= 4.9.0 - Event deletion via Cross-Site Request Forgery5.4<= 4.9.04.9.1n/a
2 Jun 2017Spiffy Calendar < 3.3.0 - Reflected Cross-Site Scripting6.1< 3.3.03.3.0n/a

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Spiffy Calendar
4 May 2026104
11 May 2026172
18 May 2026181
25 May 2026165
1 Jun 2026135
8 Jun 2026125
15 Jun 2026105
22 Jun 202699
29 Jun 2026102
6 Jul 202699
13 Jul 2026105
20 Jul 2026135
27 Jul 2026133
3 Aug 2026137
10 Aug 2026124
17 Aug 2026131
24 Aug 2026104
31 Aug 2026118
7 Sep 2026114
14 Sep 2026159
21 Sep 2026135
28 Sep 2026171
5 Oct 2026154
12 Oct 2026150
19 Oct 2026219
26 Oct 2026201
2 Nov 202652

Weekly downloads over the last 4 weeks are 16% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Events Widgets For Elementor And TheScore 100 · 10,000+Events Shortcodes For The EventsScore 96 · 10,000+WP Events ManagerScore 95 · 30,000+ICS CalendarScore 95 · 10,000+The Events Calendar Shortcode & BlockScore 94 · 10,000+

Facts

Version5.0.11
AuthorSpiffy Plugins
Added19 Nov 2012
Last updated17 Apr 2026
Active installs2,000+
Requires WordPress5.3
Tested up to6.9.11
Requires PHPnot stated
CategoryE-commerce & Shopping
Tagsblock, Event, calendar, recurring, responsive

Other plugins by this author: WP Flow Plus

Questions

Is Spiffy Calendar still maintained?

Yes. Last release 17 Apr 2026, 13 releases in the last 24 months.

Who owns Spiffy Calendar, and has it changed hands?

No change recorded. Main committer spiffyplugins since Nov 2017.

Was Spiffy Calendar removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Spiffy Calendar safe?

15 known vulnerabilities, all fixed (latest in 5.0.9). Not on the exploited list.

Is the latest Spiffy Calendar update safe to install?

No ownership change before 5.0.11. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue