WP Manifestindependent plugin directory
manifest / events / bh-wp-simple-calendar

Simple Calendar WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Display .ics calendar in WordPress

★ 0stars
3release downloads
3.3.0latest · 1mo ago

Install

Download bh-wp-simple-calendar.3.3.0.zip From the 3.3.0 release on GitHub, Aug 28, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/brianhenryie/bh-wp-simple-calendar/releases/download/3.3.0/bh-wp-simple-calendar.3.3.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress block for displaying .ics/Google calendar.

Overview

This is effectively a fork/rewrite of Simple Google Calendar Widget, one of the first plugins I tried contributing to.

Live on SacramentoGAA.org.

Frontend

Vertical list of events with dates, descriptions, locations

Backend

The plugin adds a few new blocks. The main one is Simple Calendar and the others are only available to insert inside that block (via Event Template).

Blocks in the admin UI

The main block requires setting the calendar URL. Probably a Google calendar link but any .ics URL should work. Calendars are cached for an hour and cache can be flushed in the UI.

Field and buttons to add and remove a ics url, refresh cache button, slider for number of events to display, and slider for number of days to look ahead

Use PHP date format. Time is separate so all-day events only display the date. Optionally display the end time,

Two text fields and a toggle, a link to PHP date format spec

Event location can link to Google Maps and regexes can be added to modify the address, e.g. no need to display "CA, USA" on every event for a local club, but that location information is needed for the Maps link.

Toggle to enable Google Maps link, a three-part config for regex replace, first field in a private note because regexes can be hard to understand their purpose, the regex pattern, and the replacement pattern

Event description has an option to only show the description on the first listed instance of a recurring event, so the same text is not repeated on every instance.

Toggle to only show the description on the first occurrence of a recurring event

Deprecated

  • Widget functionality/implementation should still work. Templates can be overridden in your child theme: calendar-template-1.php, calendar-item-template-1.php.

Notes

  • Cache flushes hourly, whenever the post the calendar in on is saved, or by clicking the Refresh Cache button in the block UI
  • Formatting in event descriptions in Google Calendar displays correctly (no work on my part!)

TODO

  • Allow multiple calendars to be displayed in the same block. I.e. a club could split its calendar into training/matches/social/management so people can subscribe to only what they wish, but all can be displayed on the website. (WIP)
  • Clicking an event date should display an add-to-calendar dialog

Acknowledgements

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
3.3.0 latest
Aug 28, 2026 1mo ago
bh-wp-simple-calendar.3.3.0.zip
2
Apr 11, 2026 6mo ago
bh-wp-simple-calendar.3.2.0.zip
1
C- grade

Security

Simple Calendar 3.3.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
3.3.0
Findings
1
Worst severity
high
Content hash
cf744add0a463680ac406837…

Findings

  • high Authenticated SSRF via calendar cache refresh REST endpoint

    ssrf

    REST route simple-calendar/v1/cache/refresh (POST) is permission-gated only by current_user_can('edit_posts'). The calendarUrl parameter is passed to wp_remote_get without host allowlisting, enabling editors/authors to coerce the server to fetch arbitrary URLs (internal metadata services, LAN hosts, cloud IMDS) and cache the response body. /events similarly triggers remote fetches for attacker-supplied calendarUrls.

    includes/wp-includes/class-rest-api.php:41-56

    Recommendation

    Restrict to manage_options; allowlist https hosts (e.g. calendar.google.com); block private/link-local IP ranges and IMDS; do not follow redirects to internal addresses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.