WP Manifestindependent plugin directory
manifest / events / gb-fullcalendar

GB FullCalendar WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #7 in Events & Booking

GB FullCalendar is a branch of the popular WP FullCalendar plugin written as a Gutenberg block.

★ 6stars
178release downloads
≈20active sites
v0.2.2latest · 5mo ago

Install

Download gb-fullcalendar-v0.2.2.zip From the v0.2.2 release on GitHub, May 8, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/oberhauser-dev/gb-fullcalendar/releases/download/v0.2.2/gb-fullcalendar-v0.2.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

GB FullCalendar

  • Contributors: August Oberhauser
  • Tags: block, fullcalendar, react
  • Requires at least: 5.3.2
  • Tested up to: 6.9
  • Stable tag: 0.2.2
  • Requires PHP: 7.0.0
  • License: GPL-3.0-or-later
  • License URI: https://www.gnu.org/licenses/gpl-3.0.html

GB FullCalendar is a Gutenberg block for displaying events. It's build on the popular WP FullCalendar plugin.

Description

Thanks to the Gutenberg-Blocks since the end of 2018, it has become incredibly easy to add and layout your blocks in a visual way, but still can be used with Shortcodes, too.

Features

  • Month / Week / Day and List views
  • Filter by taxonomies, such as category, tag etc.
  • Supports custom post types and custom taxonomies
  • Integrates seamlessly with Events Manager
  • Customize FullCalendar settings
  • Tooltips
  • Custom themes and styles
  • Migrating WP FullCalendar settings

Credits

Thanks to Marcus Sykes for his previous work on WP Fullcalendar, which is partially integrated here.

Installation

  1. Upload the plugin files to the /wp-content/plugins/gb-fullcalendar directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress

Usage

Note: There's no guarantee that GB FullCalendar works simultaneously with WP FullCalendar. It's recommended to only enable one plugin at the same time!

Gutenberg Block

Simply add the Gutenberg Block GB FullCalendar, which is located under the Widgets section. When you select your block, you can adjust the block-settings in the sidebar.

Shortcode

You are able to use the [fullcalendar] shortcode in one of your posts or pages, too.

The calendar can be customized

  • with Event search attributes of Events Manager.
    • Note that some attributes can differ from its internal representation in Events Manager. E.g.category is a synonym for the taxonomy event-categories
  • with FullCalendar settings.
    • Convert the keys with camel case to lowercase words separated with an underscore.
    • Add the prefix fc_.
    • Example: initialView: "listCustom" is converted to [fullcalendar fc_initial_view="listCustom"].
  • by declaring your default taxonomy terms.
    • Specify value either via the term id or the term slug.
[fullcalendar 
  category="concert, cinema, 11, theatre" 
  event-tags="mytag"
  search="Demo"
  fc_event_display="auto"
  your_custom_taxonomy_slug="your_custom_term_slug, another_custom_term_id"]

Taxonomies and Terms

You can define your own taxonomies and terms in order to categorize your events more precisely.

Themes and Styles

See documentation for themes and styles

Frequently Asked Questions (FAQ)

None yet.

Screenshots

Desktop Mobile & Theme

Changelog

See changelog file.

Contribution

You are invited to help in form of Merge-Requests or proposing issues with the expected solutions.

To develop, install the packages via yarn install. Then start webpack compiling via yarn start. To build files for production run yarn build. To build a plugin file run yarn zip-snap. The zip file will be saved in the dist folder.

The plugin is free to use. We are not liable for any damage caused by using the plugin!

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.2.2 latest
May 8, 2026 5mo ago
gb-fullcalendar-v0.2.2.zip
66
Apr 5, 2021 5 years ago
gb-fullcalendar-v0.2.1.zip
35
Jan 25, 2021 5 years ago
gb-fullcalendar-v0.2.0.zip
9
Sep 1, 2020 6 years ago
gb-fullcalendar-v0.2.0-alpha.0.zip
20
Aug 7, 2020 6 years ago
gb-fullcalendar-v0.1.0-alpha.2.zip
26
Aug 4, 2020 6 years ago
gb-fullcalendar-v0.1.0-alpha.1.zip
12
Jul 24, 2020 6 years ago
gb-fullcalendar-v0.1.0-alpha.0.zip
10

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

C- grade

Security

GB FullCalendar 0.2.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.2.2
Findings
1
Worst severity
high
Content hash
f3b4693da09c92f3242937b7…

Findings

  • high Unauthenticated AJAX tooltip leaks arbitrary post content by ID

    information_disclosure

    wp_ajax_nopriv_gbfc_tooltip_content (and the authed twin) call GbFcAjax::ajax_tooltip_content with no nonce, no current_user_can, and no is_post_publicly_viewable / post_password_required / post_status check. Any visitor can POST or GET admin-ajax.php with action=gbfc_tooltip_content and post_id set to an integer; get_post() returns that row regardless of draft/private/pending/future/trash/revision/password. The handler then puts post_excerpt, or if empty the full post_content, on a JSON object and echo json_encode. Attachment IDs leak the thumbnail URL instead. This is the same IDOR as WP FullCalendar < 1.5 (CVE-2022-3891 / wpfc_qtip_content); upstream 1.5 began issuing wpfc_item_nonce_{id} only for published calendar rows and verifying it in qtip_content. This GitHub fork never applied that patch, and the handler still runs even when the gbfc_tooltips option is off. Calendar event listing (ajax_events) correctly forces post_status=publish, so the tooltip endpoint is strictly wider than the public calendar.

    php/gb-fc-ajax.php:106-132

    Recommendation

    Before calling get_post, require a nonce minted only for posts actually returned by ajax_events (as WP FullCalendar 1.5 did with wpfc_item_nonce_{id}), or reject the request unless is_post_publicly_viewable($post) && empty($post->post_password) && current_user_can('read_post', $post->ID). Do not fall back to full post_content for unpublished or non-readable posts. Return wp_send_json_error / 403 when the post is missing or not public. Optionally skip registering the nopriv action when tooltips are disabled.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.