Skip to content
PluginCanary

The Events Calendar

by Nexcess · 600,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 74 releases in 24 months, no unpatched vulnerabilities.

85/ 100 Canary Score

Based on all 5 areas

Sub-scores for The Events Calendar
Ownership100
Maintenance100
Security60
Support96
Reputation70

How the score works

Quick answers

Is The Events Calendar still maintained?
Yes. Last release 29 Oct 2026, 74 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns The Events Calendar, and has it changed hands?
No change recorded. Main committer bordoni since Feb 2016. 4 Nov 2026 · SVN log
Was The Events Calendar removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is The Events Calendar safe?
45 known vulnerabilities, all fixed (latest in 6.18.3). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest The Events Calendar update safe to install?
No ownership change before 6.18.3. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
barry.hughes27 Mar 2014 to 30 Nov 2018, 119 commits
zbtirrell16 Jun 2015 to 7 Mar 2022, 88 commits
borkweb2 Jul 2015 to 14 Jun 2023, 66 commits
bordoni18 Feb 2016 to 14 May 2026, 432 commits
brianjessee28 Apr 2016 to 7 Feb 2019, 17 commits
ModernTribe28 Mar 2018 to 15 Jan 2020, 92 commits
sc0ttkclark29 Dec 2020 to 29 Dec 2020, 2 commits
Camwynsp15 Feb 2022 to 7 Oct 2025, 192 commits
eugenetribe10 Apr 2023 to 14 Nov 2023, 8 commits
dpantazis4 Jun 2024 to 24 Jun 2026, 89 commits
tribalmike21 Oct 2024 to 21 Oct 2024, 3 commits
sdokus23 Sep 2025 to 15 Oct 2026, 39 commits
redscar30 Sep 2025 to 8 Jul 2026, 29 commits
rafsuntaskin14 Oct 2025 to 14 Oct 2025, 3 commits
bitmachina12 May 2026 to 12 May 2026, 2 commits
filipecouto8 Jul 2026 to 24 Sep 2026, 19 commits
rahulapalu26 Aug 2026 to 10 Sep 2026, 7 commits
larodiel30 Sep 2026 to 30 Sep 2026, 3 commits
theeventscalendar29 Oct 2026 to 29 Oct 2026, 3 commits

New committer theeventscalendar made a first commit on 29 Oct 2026. New committer larodiel made a first commit on 30 Sep 2026. New committer rahulapalu made a first commit on 26 Aug 2026.

Maintenance

Last release
6 days ago
Releases, 24 months
74
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for The Events Calendar
Q1 20247
Q2 202412
Q3 202412
Q4 20247
Q1 20257
Q2 202510
Q3 202512
Q4 20259
Q1 20268
Q2 20269
Q3 202611
Q4 20263

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 4.3 (13 reviews). Lifetime: 4.2.

Average rating per quarter for The Events Calendar
Q2 20262.5
Q3 20264.2
Q4 20264.2

Average rating rose from 2.5 to 4.2 between Q2 2026 and Q4 2026.

Rating distribution
5 star1833
4 star137
3 star89
2 star75
1 star329
Latest low reviews

Security record

31 vulnerabilities in 24 months (45 on record), all patched (latest fixed in 6.18.3).

Show 45 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026The Events Calendar <= 6.18.2 - Missing Authorization4.3<= 6.18.26.18.3Patched before disclosure
30 Oct 2026The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.18.26.18.3Patched before disclosure
30 Oct 2026The Events Calendar <= 6.18.2 - Missing Authorization5.3<= 6.18.26.18.3Patched before disclosure
30 Oct 2026The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.18.26.18.3Patched before disclosure
16 Oct 2026The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.18.16.18.2Patched before disclosure
2 Oct 2026The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection8.1<= 6.17.46.17.4.1Patched before disclosure
30 Sep 2026The Events Calendar <= 6.17.5 - Missing Authorization4.3<= 6.17.56.17.5.1Patched before disclosure
28 Sep 2026The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution6.56.12.0 to 6.17.56.17.5.1Patched before disclosure
21 Sep 2026The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization4.36.15.16.1 to 6.17.4.16.17.5Patched before disclosure
21 Sep 2026The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure5.34.5 to 6.17.4.16.17.5Patched before disclosure
21 Sep 2026The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization4.36.15.0 to 6.17.4.16.17.5Patched before disclosure
11 Sep 2026The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation9.8<= 6.17.36.17.3.1Patched before disclosure
11 Sep 2026The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution9.8<= 6.17.46.17.4.1Patched before disclosure
5 Sep 2026The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure4.3< 6.17.3.16.17.3.1Patched before disclosure
24 Aug 2026The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection8.1<= 6.17.26.17.3Patched before disclosure
6 Jul 2026The Events Calendar <= 6.16.5.0 - Missing Authorization5.3<= 6.16.5.06.16.5.1Patched before disclosure
8 Jun 2026The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection7.56.15.12 to 6.16.26.16.3Patched before disclosure
9 Mar 2026The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import7.5<= 6.15.176.15.17.1Patched before disclosure
25 Feb 2026The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API5.4<= 6.15.166.15.16.1Patched before disclosure
20 Jan 2026The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control5.4<= 6.15.136.15.13.1Patched before disclosure
9 Jan 2026The Events Calendar <= 6.15.12.2 - Missing Authorization4.3<= 6.15.12.26.15.13Patched before disclosure
4 Nov 2025The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure5.3<= 6.15.96.15.10Patched before disclosure
4 Nov 2025The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s7.56.15.1.1 to 6.15.96.15.10Patched before disclosure
30 Oct 2025The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure4.3<= 6.15.96.15.10Patched before disclosure
15 Sep 2025The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure5.3<= 6.15.26.15.3Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

96% of 57 support threads resolved in the last 2 months.

Momentum

600,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for The Events Calendar
4 May 202612,240
11 May 2026744,031
18 May 202697,269
25 May 2026302,465
1 Jun 202671,010
8 Jun 202657,159
15 Jun 2026537,160
22 Jun 2026323,205
29 Jun 2026312,128
6 Jul 2026342,720
13 Jul 202674,388
20 Jul 2026304,925
27 Jul 202672,966
3 Aug 2026340,190
10 Aug 202662,170
17 Aug 2026329,124
24 Aug 2026337,032
31 Aug 2026320,612
7 Sep 2026335,743
14 Sep 2026353,674
21 Sep 2026337,352
28 Sep 2026310,857
5 Oct 2026101,157
12 Oct 2026508,384
19 Oct 202689,946
26 Oct 2026327,300
2 Nov 202619,231

Weekly downloads over the last 4 weeks are 9% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Events Widgets For Elementor And TheScore 100 · 10,000+Events Shortcodes For The EventsScore 96 · 10,000+WP Events ManagerScore 95 · 30,000+ICS CalendarScore 95 · 10,000+The Events Calendar Shortcode & BlockScore 94 · 10,000+

Facts

Version6.18.3
AuthorNexcess
Added19 Jan 2010
Last updated29 Oct 2026
Active installs600,000+
Requires WordPress6.9
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
TagsEvent, events, calendar, schedule, organizer

Other plugins by this author: Kadence Security - Password, Two Factor Authentication, and Brute Force Protection, Kadence Blocks - Page Builder Toolkit for Gutenberg Editor, Kadence Starter Templates - Predesigned Website Templates, GiveWP - Donation Plugin and Fundraising Platform, Image Widget, Event Tickets and Registration, Kadence WooCommerce Email Designer, Virtue/Ascend/Pinnacle Toolkit, Kadence Central - Site Management, Backups, Security, and Reporting, Membership Plugin - Kadence Memberships, GiveWP Donation Widgets for Elementor, Solid Performance - Your No-Code Caching, Performance, & Page Speed Solution

Questions

Is The Events Calendar still maintained?

Yes. Last release 29 Oct 2026, 74 releases in the last 24 months.

Who owns The Events Calendar, and has it changed hands?

No change recorded. Main committer bordoni since Feb 2016.

Was The Events Calendar removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is The Events Calendar safe?

45 known vulnerabilities, all fixed (latest in 6.18.3). Not on the exploited list.

Is the latest The Events Calendar update safe to install?

No ownership change before 6.18.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue