The Events Calendar

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 37% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ David Tierney

   1mo ago

   I’ve been a long-time user of The Events Calendar Pro, and for years it served my clients somewhat well – not great, but well enough to stick with it. (Issues until now have been that the plugin is a massive drain on hosting resources and their version upgrades break things.) Since Liquid Web took over, the experience has deteriorated significantly — not with the plugin itself, but with everything around it: licensing, support, and pricing transparency. Here’s what I’ve run into: The license dashboard gives two conflicting answers in two different places — one showing the license as expired, another showing it as active. Acting on the download link provided, I downloaded what was labeled as version 7.8.0 of Events Calendar Pro. When I attempted to install it, WordPress identified the actual plugin version inside the zip as 5.14.5 — significantly older than the 7.7.14 already installed on my site. I was nearly prompted to downgrade without realizing it. I submitted a support ticket four days ago with these details. I received an automated acknowledgment and nothing since. On pricing: it’s genuinely unclear whether existing single-plugin license holders are being migrated to the new bundle pricing (which is roughly three times what we were paying) or whether we can continue renewing at the previous rate. The dashboard and communications don’t answer this clearly. There seems to be only one way to pay for my license and that is to pay for a full software bundle at 3 times the price. I’m not writing this to be harsh — I understand that acquisitions are complicated and transitions take time. But for working professionals managing client sites, a broken license dashboard, a mislabeled download, and four days of silence from support aren’t minor inconveniences. They affect real client work. And from looking online, it looks like none of this is just me. The issue with Liquid Web has led me to seek another solution.

   Read on wp.org ↗
2. ★★★★★ jodword

   2mo ago

   The plugin is really easy and if you do encounter issue, the support is great!!

   Read on wp.org ↗
3. ★★★★★ Alexandre Buffet

   2mo ago

   It had been years since I last used this plugin, so I decided to give it another try. I was genuinely hoping things had improved, but I came away quite disappointed. As a WordPress developer, I found the latest version unnecessarily complex and frustrating to work with. Simply activating it produced numerous PHP warnings in my development environment, which immediately raised concerns about code quality and attention to WordPress best practices. The biggest disappointment, however, is the Block Editor integration. Astonishingly, it’s not even enabled by default, you first have to find and enable an option to use it. In 2026, that’s hard to understand! Unfortunately, enabling it doesn’t improve the experience much. It doesn’t feel like a native WordPress experience at all. Event metadata is tightly coupled to the plugin’s blocks, so if you remove those blocks from a Single Event template, you also lose the ability to properly edit the event’s metadata. Rather than integrating with the Block Editor, the plugin forces you into its own awful editing model. The blocks themselves don’t behave like native, composable WordPress blocks. Their UI feels inconsistent with the rest of the editor, the icons are oversized and visually out of place, and the overall editing experience feels clunky rather than seamless. Overall, this plugin feels more like a large legacy framework layered on top of WordPress than a plugin that embraces Gutenberg conventions and philosophy. It offers many features, but at the cost of simplicity, consistency, and developer experience. I can’t recommend this plugin in its current state. I hope the team behind it takes this feedback seriously and rethinks its approach to WordPress integration.

   Read on wp.org ↗
4. ★★★★★ jrslam

   2mo ago

   I confess that after an upgrade that I was not aware of, the events calendar started behaving badly. Tech-support couldn’t quite figure out what was going on, so I shopped around for a different calendar program. I must honestly say nothing compared. So my solution was to contact Claude AI, and Claude solved the issue. The Events Calendar is awesome, and I could not find anything that was a close competitor. The problem I encountered was partly my own doing in customizing it, so it wasn’t surprising that tech-support couldn’t figure out what had happened, but it’s all resolved and I’m back very happy with it.

   Read on wp.org ↗
5. ★★★★★ Gene White Jr.

   2mo ago

   After Nexcess took over the plugin, I have now emailed them 3 times trying to renew the license I have for the plugin from the original makers of the product who were very good at responding to their customers and solving the support issues, but they have yet to respond to me. At this point I will NOT be renewing the license. For the following reasons. They do not respond to support and or billing questions. Their new pricing is ridiculously high. Over $140.00 more than the last license I purchased from them. I have been reading the reviews since Nexcess took over the plugin and none are happy with their response to email questions. Most having the same issue that I do. As in they do not respond to support questions or anything apparently. They changed the code in the plugin to add a menu for pay plugins without notifying the customer that this would happen. This behaviour makes the entire plugin suspicious. If they are doing this on the front end what are they doing in the back end? Stay away from this plugin. Stay away from this plugin provider. Their changes are not worth paying $140.00 more a year for a plugin that is adding things to your WordPress menu that are not directly related to your current version of the calendar. There should never be an addition of a menu that does nothing more than advertise their pay versions.

   Read on wp.org ↗
6. ★★★★★ andrewtgh

   2mo ago

   I’d been using this software for years, with mostly positive experience. Until I tried reaching out for support for a billing/licencing issue under the “new” Liquid Web ownership. Absolutely no response to any of the three support tickets I’ve raised – I get an acknowledgement, so I know it’s not a spam filter problem. They just seem to have stopped responding. I would now recommend that potential customers avoid this software like the plague due to lack of support, which is a shame because it used to work very well for our needs. We’re now starting a project to assess alternatives and switch over.

   Read on wp.org ↗
7. ★★★★★ uniguide

   3mo ago

   I paid for the premium version of the plugin and see its limitations. I was willing to upgrade, but they do not respond to support requests despite multiple attempts. Links don’t take you to where they say they will. Looks like they are putting zero effort into this. Do not waster you money. Highway robbery.

   Read on wp.org ↗
8. ★★★★★ April

   3mo ago

   This plugin has caused too many error codes and issues for me since installing. Now I am getting a huge list of errors when I first load the events page, so there is no telling what other kind of behind-the-scenes issues this is causing. Uninstalling and trying to find something else.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-20 Version 6.17.3 Security – Hardened validation of copied legacy widget instances. Tweak – Switched changelog tooling from jetpack-changelogger to @stellarwp/changelogger. Fix – Resolved an issue where the events archive page title showe 6.17.3
2. 2026-08-05 Version 6.17.2 Language – 5 new strings added, 95 updated, 0 fuzzied, and 0 obsoleted. Tweak – Improved the unified licensing page experience. Tweak – Switched changelog tooling from jetpack-changelogger to @stellarwp/changelogger. 6.17.2
3. 2026-07-22 Version 6.17.1 Fix – Corrected CSV imports that failed to show any records on sites with a symlinked uploads folder. Fix – Resolved an issue where event times rendered in UTC on WooCommerce order pages and emails when PHP’s default tim 6.17.1
4. 2026-07-08 Version 6.17.0 Compatibility – Improved PHP compatibility for versions 7.4 and up to 8.4. Language – 0 new strings added, 59 updated, 0 fuzzied, and 0 obsoleted. 6.17.0
5. 2026-07-01 Version 6.16.5.1 Security – Expanded validation of Event Aggregator imports for all statuses. Language – 0 new strings added, 0 updated, 0 fuzzied, and 0 obsoleted. 6.16.5.1
6. 2026-06-24 Version 6.16.5 Feature – Added “SEO & URL Handling” settings, allowing site owners to configure out-of-range URL behavior. Fix – Dated List view URLs carrying ?tribe-bar-date outside the known event range now return HTTP 404 by default 6.16.5

30 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 The Events Calendar <= 6.16.5.0 - Missing Authorization ↗
   2026-07-06 CVE-2026-13390 Missing Authorization Affects <= 6.16.5.0 Patched in 6.16.5.1
2. High · 7.5 The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection ↗
   2026-06-08 CVE-2026-49772 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects 6.15.12 - 6.16.2 Patched in 6.16.3
3. High · 7.5 The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import ↗
   2026-03-09 CVE-2026-3585 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.15.17 Patched in 6.15.17.1
4. Medium · 5.4 The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API ↗
   2026-02-25 CVE-2026-2694 Improper Authorization Affects <= 6.15.16 Patched in 6.15.16.1
5. Medium · 5.4 The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control ↗
   2026-01-20 CVE-2025-15043 Missing Authorization Affects <= 6.15.13 Patched in 6.15.13.1
6. Medium · 4.3 The Events Calendar <= 6.15.12.2 - Missing Authorization ↗
   2026-01-09 CVE-2025-69352 Missing Authorization Affects <= 6.15.12.2 Patched in 6.15.13
7. Medium · 5.3 The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure ↗
   2025-11-04 CVE-2025-12192 Incorrect Comparison Affects <= 6.15.9 Patched in 6.15.10
8. High · 7.5 The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s ↗
   2025-11-04 CVE-2025-12197 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects 6.15.1.1 - 6.15.9 Patched in 6.15.10
9. Medium · 4.3 The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ↗
   2025-10-30 CVE-2025-12175 Missing Authorization Affects <= 6.15.9 Patched in 6.15.10
10. Medium · 5.3 The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure ↗
    2025-09-15 CVE-2025-9808 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.15.2 Patched in 6.15.3
11. High · 7.5 The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection ↗
    2025-09-11 CVE-2025-9807 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.15.1 Patched in 6.15.1.1
12. Medium · 6.4 The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ↗
    2025-06-10 CVE-2025-5144 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.13.2 Patched in 6.13.2.1
13. Medium · 4.3 The Events Calendar <= 6.11.2.1 - Missing Authorization ↗
    2025-05-19 CVE-2025-48246 Missing Authorization Affects <= 6.11.2.1 Patched in 6.12.0
14. Medium · 6.4 The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-01-22 CVE-2024-12118 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.9.0 Patched in 6.9.1
15. Medium · 4.3 The Events Calendar <= 6.7.0 - Cross-Site Request Forgery ↗
    2025-01-09 CVE-2025-24537 Cross-Site Request Forgery (CSRF) Affects <= 6.7.0 Patched in 6.7.1
16. Medium · 5.3 The Events Calendar <= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure ↗
    2024-11-25 CVE-2024-5333 Exposure of Sensitive Information Through Data Queries Affects <= 6.8.2 Patched in 6.8.2.1
17. Critical · 9.8 The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection ↗
    2024-09-24 CVE-2024-8275 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.6.4 Patched in 6.6.4.1
18. Medium · 4.4 The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-31 CVE-2024-8493 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.6.3 Patched in 6.6.4
19. High · 7.2 The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-07-23 CVE-2024-6931 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.6.3 Patched in 6.6.4
20. Medium · 4.3 The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events ↗
    2024-07-05 CVE-2024-37518 Cross-Site Request Forgery (CSRF) Affects <= 6.5.1.4 Patched in 6.5.1.5
21. Medium · 4.3 The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access ↗
    2024-05-24 CVE-2024-1295 Missing Authorization Affects <= 6.4.0 Patched in 6.4.0.1
22. Medium · 6.1 The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting ↗
    2024-05-14 CVE-2024-4180 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.0 Patched in 6.4.0.1
23. Medium · 4.3 The Events Calendar <= 6.3.0 - Cross-Site Request Forgery to Notice Dismissal ↗
    2024-04-10 CVE-2024-31433 Cross-Site Request Forgery (CSRF) Affects <= 6.3.0 Patched in 6.3.1
24. Medium · 5.3 The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure ↗
    2024-01-12 CVE-2023-6557 Missing Authorization Affects <= 6.2.8.2 Patched in 6.2.9
25. Medium · 5.3 The Events Calendar <= 6.2.8 - Information Disclosure ↗
    2023-11-20 CVE-2023-6203 Exposure of Sensitive Information Through Data Queries Affects < 6.2.8.1 Patched in 6.2.8.1
26. Medium · 4.3 The Events Calendar <= 6.1.2.2 - Missing Authorization ↗
    2023-07-25 CVE-2023-35777 Missing Authorization Affects <= 6.1.2.2 Patched in 6.1.3
27. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 4.9.0 - 5.16.4 Patched in 5.16.4.1
28. Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 5.14.0.4 Patched in 5.14.0.4
29. Medium · 6.1 The Events Calendar <= 4.8.1 - Cross-Site Scripting via tribe_paged Parameter ↗
    2019-03-04 CVE-2019-15109 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.8.2 Patched in 4.8.2
30. Medium · 4.7 The Events Calendar < 4.1.1.1 - Open Redirect ↗
    2016-04-25 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 4.1.1 Patched in 4.1.1.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 94 languages, 10 at 90% or more

Plus 70 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-22 700K+ → 600K+ down after 1061 days in tier
2. 2023-08-26 800K+ → 700K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Events Calendar for GeoDirectory 3K+ installs · 4.1★ · 5 shared tags B
• WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce 20K+ installs · 4.0★ · 4 shared tags A
• Bulk Edit Events – Create Events in a Bulk Editor 100+ installs · 4.1★ · 4 shared tags A
• Timetable and Event Schedule by MotoPress 30K+ installs · 4.3★ · 3 shared tags A
• The Events Calendar Shortcode & Block 10K+ installs · 4.6★ · 3 shared tags A
• Events Calendar by FooEvents 4K+ installs · 3.8★ · 3 shared tags B

Embed this report card

Drop a live Pulse card for The Events Calendar into a readme, a review or a deck. It updates itself.

The Events Calendar: 600K+ active installs, 4.2★ (2,450 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/the-events-calendar