CVE-2025-12898
Published
CVSS v3
5.3
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings.
<h4>Plugin Migration Notice</h4>
<p>Pretty Google Calendar is transitioning to <a href="https://wordpress.org/plugins/hydrogen-calendar-embeds/" rel="ugc">Hydrogen Calendar Embeds</a>. Please install that plugin for future updates and improvements.</p>
<h4>Why Switch to Hydrogen Calendar Embeds?</h4>
<ul>
<li>No more fussing with the Google API — just use simple .ics calendar feeds</li>
<li>Display any calendar that provides a public .ics feed (e.g. Google Calendar, Apple Calendar, Outlook, etc.)</li>
<li>Works with <strong>blocks</strong> <em>and</em> <strong>shortcodes</strong></li>
<li>More features, fewer bugs, and still lightweight</li>
<li>100% FREE</li>
<li>Active development and ongoing support</li>
</ul>
<h4>Legacy Pretty Google Calendar Features</h4>
<p><strong>You:</strong> I just want to embed a Google Calendar in my WordPress site.<br />
<strong>Google:</strong> Here’s a special kind of ugly!<br />
<strong>Pretty Google Calendar:</strong> I got this.</p>
<p>This is a light and simple to use plugin that embeds Google Calendars in your website with style, beauty and grace.</p>
<p><strong>Highlights:</strong></p>
<ul>
<li>Out of the box support for calendar grid and agenda list view (and most other FullCalendar views)</li>
<li>Responsive design switches to list view on smaller screens</li>
<li>List view customizable to day, week, month, year or custom number of days</li>
</ul>
<p><strong>How it works:</strong></p>
<ol>
<li>Continue to manage events using Google Calendar as you’ve always done.</li>
<li>Add a shortcode to your page.</li>
<li>Sigh with relief.</li>
<li>That’s it.</li>
</ol>