WP Manifestindependent plugin directory
manifest / events / squarecandy-acf-events

Square Candy ACF Events WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A WordPress plugin for managing and displaying events. Depends on the ACF Pro plugin.

★ 8stars
v1.11.1latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/squarecandy/squarecandy-acf-events/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A custom events plugin using Advanced Custom Fields

  • Requires Advanced Custom Fields Pro 5.x
  • Outputs HTML including schema.org structured data
  • A basic, easy to use events system

Settings

  • See available settings at Events > Event Settings
    • Date formatting options
    • Google Maps API key integration
    • Additional Mapping options
    • Display options

Shortcodes

Default:

Show Upcoming Events in the standard format

[squarecandy_events]
or
echo squarecandy_events_func();

Archive:

Show Past Events in the standard format

[squarecandy_events type=past]
or
echo squarecandy_events_func( array('type'=>'past') );

All:

Show All Events (past, present and future) in the standard format

[squarecandy_events type=all]
or
echo squarecandy_events_func( array('type'=>'all') );

Compact:

Show the compact events block. This is good for sidebars, a homepage block, or other place where a compact preview of upcoming events is needed.

[squarecandy_events style=compact]
or
echo squarecandy_events_func( array('style'=>'compact') );

Category Filter:

Filter the list by Event Category. The example below assumes you have already created an event category called "My Example Category" and applied that category to some event items.

[squarecandy_events cat=my-example-category]
or
echo squarecandy_events_func( array('cat'=>'my-example-category') );

Combinations:

Combine any of the above as needed...

[squarecandy_events type=past style=compact cat=my-example-category]

Advanced:

More options are now available:

  • not_in=123,125,127 // filter out specific events by ID
  • posts_per_page=3 // override total posts returned
  • only_featured=true // filter for featured posts only
  • featured_at_top=true // order featured posts at top
  • exclude_featured=true // filter out featured posts
  • more_info_post_link=true // force the more info button to appear by default & link to the single post instead of to an external website
  • year_sort="ASC" // sort the past events accordion style years old to new (defaults to new to old)
  • subevent_sort="DESC" // sort the sub-events of each past year accordion style new to old (defaults to old to new)
  • accordion=true // force the past events archive into accordion/non-accordion mode. Overrides the global Event settings when used in a shortcode.

Filters

Available filters:

  • squarecandy_filter_events_fields - filter the ACF fields array
  • squarecandy_filter_events_supports - filter the array of components the post type supports ( 'title', 'editor', 'author', 'thumbnail' )

Fields/Meta Guide

post_type = 'event'

featured - bool - Featured Event or no start_date - stored as ? displayed as F j, Y all_day - bool multi_day - bool start_time - stored as ? displayed as g:i a end_date end_time venue - text address - text city - text state - text zip - text country - select venue_location - google_map - optional if google maps api zoom_level - range - optional if google maps api more_info_link - url tickets_link - url facebook_link - url short_description - wysiwyg category - taxonomy (events-category) save_terms = 1 archive_date - autogenerated Y-m-d H:i:s sort_date - autogenerated Y-m-d H:i:s magic_sort_date - autogenerated Y-m-d H:i:s featured_works - post_object - optional - if works plugin active

Developer Guide

For more detailed information about coding standards, development philosophy, how to run linting, how to release a new version, and more, visit the Square Candy Developer Guide Wiki.

Roadmap

  • add cancelled feature and corresponding schema https://schema.org/EventCancelled
  • add online location feature https://schema.org/VirtualLocation https://schema.org/BroadcastEvent
  • install Gamajo and make single template overridable
  • refactor item previews to use an overridable template file, but don't break shortcodes in the process.
  • past events accordions: refactor for less queries
  • past events accordions: offer ASC and DESC year sorting
  • past events accordions: offer ASC and DESC item sorting within each year
  • past events accordions: accessibility fixes for accordion feature
  • page-per-year archive: SEO fixes for single year past https://example.com/events/2022/ - add year to title, unique description.
  • refactor button icons and labels: make consistent between preview and single; icons always optional; FA6 compatible; etc
  • consider a full refactor of external links? replace More Info/Tickets/Facebook fields with a repeater to allow for any amount/kind of external link.
  • refactor/rethink: "MORE INFO" button in preview links to single view; "MORE INFO" button in single links to external URL; "MORE INFO" is generic and not accessible.
  • accessibility review for entire system
  • Check if any clients are using the Google Maps integration anymore. Remove the feature and the code if not.
  • Create a v2 css option with a better basic/default look and CSS variables where appropriate.
  • Support more preview image positions (left, right, top)
  • Improve "add to calendar" to include more than Google.
  • make options for both "past" and "all" to be grouped by year independently
  • Consider performance limits for all past/archive options (full Past shortcode, Past shortcode with year accordions, page-per-year archives). Implement pagination, AJAX or load-more solutions past reasonable limitations.

done

  • create hidden takedown/archive date for smoother queries
  • throw error if end date is before start date

Releases

2 releases.

Tag
Published
v1.11.1 latest
Jul 29, 2026 2mo ago
May 21, 2026 5mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Square Candy ACF Events 1.11.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.11.1
Findings
2
Worst severity
high
Content hash
415457bbe8642b5186304abf…

Findings

  • high Author+ stored XSS via unescaped event URL fields in href

    xss_stored

    The event CPT uses default post capabilities, so Author can publish events and Contributor can save them for preview/publish. ACF url fields tickets_link, venue_link, more_info_link, facebook_link, and more_info_buttons.link are validated only with strpos($value, '://') (or a leading //) — not FILTER_VALIDATE_URL or esc_url_raw. For users without unfiltered_html, ACF runs wp_kses_post_deep on $_POST['acf']; that strips tags/event handlers when the value is HTML, but a URL string such as https://example.com/foo"onmouseover="alert(1) has no tags, so quotes survive. squarecandy_events_generate_buttons() and get_squarecandy_acf_events_address_display() then concatenate those values into href attributes with no esc_url/esc_attr. The resulting markup is <a href="https://example.com/foo"onmouseover="alert(1)"> on single event pages, [squarecandy_events] listings, archives, and AJAX load-more HTML. A published payload executes for every visitor (cookie theft / session hijack). javascript://… also passes the :// check. Editors/admins already have unfiltered_html on single site; the bug is that Author/Contributor do not, yet they can still inject handlers.

    functions.php:397-398,747-786

    Recommendation

    Pass every event URL through esc_url() before putting it in href (and esc_html/esc_attr for venue, address, button_text). Reject values that fail wp_http_validate_url() / esc_url_raw() on save. Do not treat ACF input sanitization as a substitute for output escaping.

  • medium Unauthenticated AJAX load-more concatenates POST into do_shortcode

    unsafe_input

    When the Event Settings checkbox options_events_ajax_load_more is enabled, inc/ajax-load-more.php registers wp_ajax_nopriv_events_load_more. The handler only checks wp_verify_nonce($_POST['nonce'], 'events-ajax-nonce'); that nonce is localized onto every frontend page as eventsdata.nonce (wp_create_nonce works for uid 0). page is cast to int, but eventType and archiveYear are only esc_attr()'d, then interpolated as unquoted shortcode attributes: [squarecandy_events ajax=1 page=N type={eventType} archive_year={archiveYear}]. esc_attr does not encode space or ], so an unauthenticated client can (1) inject extra attributes such as posts_per_page=-1 — squarecandy_events_func treats -1 as valid because !empty('-1') && -1 <= 2500, so WP_Query loads every published event — and (2) close the shortcode with ] and execute a second registered shortcode. The response is inserted into the DOM with jQuery .before() in js/main.js. Feature is off until an administrator enables Load More.

    inc/ajax-load-more.php:3-23

    Recommendation

    Do not build a shortcode string from request data. Call squarecandy_events_func() with a PHP array whose keys are allowlisted (type in upcoming|past|all, archive_year absint, page absint). Cap posts_per_page to a positive integer and never honor extra attributes from the client.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.