The Events Calendar

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1505 searches this plugin appeared in over the last 90 days, 20 listed. 1414 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3 months ago and the previous band took 2.9 years to cross, so the real count is still just under 700K.

1. ★★★★★ David Tierney

   4mo ago

   I’ve been a long-time user of The Events Calendar Pro, and for years it served my clients somewhat well – not great, but well enough to stick with it. (Issues until now have been that the plugin is a massive drain on hosting resources and their version upgrades break things.) Since Liquid Web took over, the experience has deteriorated significantly — not with the plugin itself, but with everything around it: licensing, support, and pricing transparency. Here’s what I’ve run into: The license dashboard gives two conflicting answers in two different places — one showing the license as expired, another showing it as active. Acting on the download link provided, I downloaded what was labeled as version 7.8.0 of Events Calendar Pro. When I attempted to install it, WordPress identified the actual plugin version inside the zip as 5.14.5 — significantly older than the 7.7.14 already installed on my site. I was nearly prompted to downgrade without realizing it. I submitted a support ticket four days ago with these details. I received an automated acknowledgment and nothing since. On pricing: it’s genuinely unclear whether existing single-plugin license holders are being migrated to the new bundle pricing (which is roughly three times what we were paying) or whether we can continue renewing at the previous rate. The dashboard and communications don’t answer this clearly. There seems to be only one way to pay for my license and that is to pay for a full software bundle at 3 times the price. I’m not writing this to be harsh — I understand that acquisitions are complicated and transitions take time. But for working professionals managing client sites, a broken license dashboard, a mislabeled download, and four days of silence from support aren’t minor inconveniences. They affect real client work. And from looking online, it looks like none of this is just me. The issue with Liquid Web has led me to seek another solution.

   Read on wp.org ↗
2. ★★★★★ jodword

   4mo ago

   The plugin is really easy and if you do encounter issue, the support is great!!

   Read on wp.org ↗
3. ★★★★★ Alexandre Buffet

   4mo ago

   It had been years since I last used this plugin, so I decided to give it another try. I was genuinely hoping things had improved, but I came away quite disappointed. As a WordPress developer, I found the latest version unnecessarily complex and frustrating to work with. Simply activating it produced numerous PHP warnings in my development environment, which immediately raised concerns about code quality and attention to WordPress best practices. The biggest disappointment, however, is the Block Editor integration. Astonishingly, it’s not even enabled by default, you first have to find and enable an option to use it. In 2026, that’s hard to understand! Unfortunately, enabling it doesn’t improve the experience much. It doesn’t feel like a native WordPress experience at all. Event metadata is tightly coupled to the plugin’s blocks, so if you remove those blocks from a Single Event template, you also lose the ability to properly edit the event’s metadata. Rather than integrating with the Block Editor, the plugin forces you into its own awful editing model. The blocks themselves don’t behave like native, composable WordPress blocks. Their UI feels inconsistent with the rest of the editor, the icons are oversized and visually out of place, and the overall editing experience feels clunky rather than seamless. Overall, this plugin feels more like a large legacy framework layered on top of WordPress than a plugin that embraces Gutenberg conventions and philosophy. It offers many features, but at the cost of simplicity, consistency, and developer experience. I can’t recommend this plugin in its current state. I hope the team behind it takes this feedback seriously and rethinks its approach to WordPress integration.

   Read on wp.org ↗
4. ★★★★★ jrslam

   4mo ago

   I confess that after an upgrade that I was not aware of, the events calendar started behaving badly. Tech-support couldn’t quite figure out what was going on, so I shopped around for a different calendar program. I must honestly say nothing compared. So my solution was to contact Claude AI, and Claude solved the issue. The Events Calendar is awesome, and I could not find anything that was a close competitor. The problem I encountered was partly my own doing in customizing it, so it wasn’t surprising that tech-support couldn’t figure out what had happened, but it’s all resolved and I’m back very happy with it.

   Read on wp.org ↗
5. ★★★★★ Gene White Jr.

   4mo ago

   After Nexcess took over the plugin, I have now emailed them 3 times trying to renew the license I have for the plugin from the original makers of the product who were very good at responding to their customers and solving the support issues, but they have yet to respond to me. At this point I will NOT be renewing the license. For the following reasons. They do not respond to support and or billing questions. Their new pricing is ridiculously high. Over $140.00 more than the last license I purchased from them. I have been reading the reviews since Nexcess took over the plugin and none are happy with their response to email questions. Most having the same issue that I do. As in they do not respond to support questions or anything apparently. They changed the code in the plugin to add a menu for pay plugins without notifying the customer that this would happen. This behaviour makes the entire plugin suspicious. If they are doing this on the front end what are they doing in the back end? Stay away from this plugin. Stay away from this plugin provider. Their changes are not worth paying $140.00 more a year for a plugin that is adding things to your WordPress menu that are not directly related to your current version of the calendar. There should never be an addition of a menu that does nothing more than advertise their pay versions.

   Read on wp.org ↗
6. ★★★★★ andrewtgh

   5mo ago

   I’d been using this software for years, with mostly positive experience. Until I tried reaching out for support for a billing/licencing issue under the “new” Liquid Web ownership. Absolutely no response to any of the three support tickets I’ve raised – I get an acknowledgement, so I know it’s not a spam filter problem. They just seem to have stopped responding. I would now recommend that potential customers avoid this software like the plague due to lack of support, which is a shame because it used to work very well for our needs. We’re now starting a project to assess alternatives and switch over.

   Read on wp.org ↗
7. ★★★★★ uniguide

   5mo ago

   I paid for the premium version of the plugin and see its limitations. I was willing to upgrade, but they do not respond to support requests despite multiple attempts. Links don’t take you to where they say they will. Looks like they are putting zero effort into this. Do not waster you money. Highway robbery.

   Read on wp.org ↗
8. ★★★★★ April

   5mo ago

   This plugin has caused too many error codes and issues for me since installing. Now I am getting a huge list of errors when I first load the events page, so there is no telling what other kind of behind-the-scenes issues this is causing. Uninstalling and trying to find something else.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-29 Version 6.18.3 Language – 0 new strings added, 34 updated, 0 fuzzied, and 0 obsoleted. Security – Hardened access control checks for linked Organizers, Venues, and the Ignored Events admin action. Props to fcc for reporting. Security – 6.18.3
2. 2026-10-15 Version 6.18.2 Language – 0 new strings added, 13 updated, 0 fuzzied, and 0 obsoleted. Security – Restricted the HTML tag settings of the Elementor widgets to a fixed list of tags. Tweak – Added filters: tec_events_elementor_widget_all 6.18.2
3. 2026-10-13 Version 6.18.1 Fix – Prevented a fatal error when manually running a Scheduled Import whose child record could not be created, reporting the failure as an import error instead. Fix – Resolved an issue where the List view exposed an int 6.18.1
4. 2026-09-30 Version 6.18.0 Fix – Prevented a rejected CSV import column mapping from being saved as the default, which caused later imports to pre-select “Do Not Import” for required columns. Language – 0 new strings added, 13 updated, 0 fuzzied, 6.18.0
5. 2026-09-24 Version 6.17.5.1 Language – 0 new strings added, 0 updated, 0 fuzzied, and 0 obsoleted. Security – Hardened author assignment in the REST API. Security – Hardened the rendering of the Events QR Code widget. Props to Jakub Herman for repo 6.17.5.1
6. 2026-09-17 Version 6.17.5 Compatibility – Registered the plugin’s editor blocks with Block API version 3 so they render correctly inside the iframed block editor introduced in WordPress 6.9. Fix – Prevented event pages and iCal exports from faili 6.17.5

All 41 disclosed vulnerabilities are patched in the current version (6.18.3). Sites still on an older version should update.

1. Patched Medium · 6.4 The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-16 CVE-2026-110903 Improper Neutralization of Input During Web Page Generation Affects <= 6.18.1 Patched in 6.18.2
2. Patched High · 8.1 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection ↗
   2026-10-02 CVE-2026-95606 Deserialization of Untrusted Data Affects <= 6.17.4 Patched in 6.17.4.1
3. Patched Medium · 4.3 The Events Calendar <= 6.17.5 - Missing Authorization ↗
   2026-09-30 CVE-2026-97285 Missing Authorization Affects <= 6.17.5 Patched in 6.17.5.1
4. Patched Medium · 6.5 The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-09-28 CVE-2026-84740 Improper Control of Generation of Code Affects 6.12.0 - 6.17.5 Patched in 6.17.5.1
5. Patched Medium · 4.3 The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization ↗
   2026-09-21 CVE-2026-84742 Incorrect Authorization Affects 6.15.0 - 6.17.4.1 Patched in 6.17.5
6. Patched Medium · 4.3 The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization ↗
   2026-09-21 CVE-2026-84743 Incorrect Authorization Affects 6.15.16.1 - 6.17.4.1 Patched in 6.17.5
7. Patched Medium · 5.3 The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure ↗
   2026-09-21 CVE-2026-84741 Exposure of Sensitive Information to an Unauthorized Actor Affects 4.5 - 6.17.4.1 Patched in 6.17.5
8. Patched Critical · 9.8 The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation ↗
   2026-09-11 CVE-2026-78159 Improper Control of Generation of Code Affects <= 6.17.3 Patched in 6.17.3.1
9. Patched Critical · 9.8 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution ↗
   2026-09-11 CVE-2026-78006 Deserialization of Untrusted Data Affects <= 6.17.4 Patched in 6.17.4.1
10. Patched Medium · 4.3 The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure ↗
    2026-09-05 CVE-2026-84745 Exposure of Sensitive Information to an Unauthorized Actor Affects < 6.17.3.1 Patched in 6.17.3.1
11. Patched High · 8.1 The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection ↗
    2026-08-24 CVE-2026-78265 Deserialization of Untrusted Data Affects <= 6.17.2 Patched in 6.17.3
12. Patched Medium · 5.3 The Events Calendar <= 6.16.5.0 - Missing Authorization ↗
    2026-07-06 CVE-2026-13390 Missing Authorization Affects <= 6.16.5.0 Patched in 6.16.5.1
13. Patched High · 7.5 The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection ↗
    2026-06-08 CVE-2026-49772 Improper Neutralization of Special Elements used in an SQL Command Affects 6.15.12 - 6.16.2 Patched in 6.16.3
14. Patched High · 7.5 The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import ↗
    2026-03-09 CVE-2026-3585 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.15.17 Patched in 6.15.17.1
15. Patched Medium · 5.4 The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API ↗
    2026-02-25 CVE-2026-2694 Improper Authorization Affects <= 6.15.16 Patched in 6.15.16.1
16. Patched Medium · 5.4 The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control ↗
    2026-01-20 CVE-2025-15043 Missing Authorization Affects <= 6.15.13 Patched in 6.15.13.1
17. Patched Medium · 4.3 The Events Calendar <= 6.15.12.2 - Missing Authorization ↗
    2026-01-09 CVE-2025-69352 Missing Authorization Affects <= 6.15.12.2 Patched in 6.15.13
18. Patched Medium · 5.3 The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure ↗
    2025-11-04 CVE-2025-12192 Incorrect Comparison Affects <= 6.15.9 Patched in 6.15.10
19. Patched High · 7.5 The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s ↗
    2025-11-04 CVE-2025-12197 Improper Neutralization of Special Elements used in an SQL Command Affects 6.15.1.1 - 6.15.9 Patched in 6.15.10
20. Patched Medium · 4.3 The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ↗
    2025-10-30 CVE-2025-12175 Missing Authorization Affects <= 6.15.9 Patched in 6.15.10
21. Patched Medium · 5.3 The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure ↗
    2025-09-15 CVE-2025-9808 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.15.2 Patched in 6.15.3
22. Patched High · 7.5 The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection ↗
    2025-09-11 CVE-2025-9807 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.15.1 Patched in 6.15.1.1
23. Patched Medium · 6.4 The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ↗
    2025-06-10 CVE-2025-5144 Improper Neutralization of Input During Web Page Generation Affects <= 6.13.2 Patched in 6.13.2.1
24. Patched Medium · 4.3 The Events Calendar <= 6.11.2.1 - Missing Authorization ↗
    2025-05-19 CVE-2025-48246 Missing Authorization Affects <= 6.11.2.1 Patched in 6.12.0
25. Patched Medium · 6.4 The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-01-22 CVE-2024-12118 Improper Neutralization of Input During Web Page Generation Affects <= 6.9.0 Patched in 6.9.1
26. Patched Medium · 4.3 The Events Calendar <= 6.7.0 - Cross-Site Request Forgery ↗
    2025-01-09 CVE-2025-24537 Cross-Site Request Forgery Affects <= 6.7.0 Patched in 6.7.1
27. Patched Medium · 5.3 The Events Calendar <= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure ↗
    2024-11-25 CVE-2024-5333 Exposure of Sensitive Information Through Data Queries Affects <= 6.8.2 Patched in 6.8.2.1
28. Patched Critical · 9.8 The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection ↗
    2024-09-24 CVE-2024-8275 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.6.4 Patched in 6.6.4.1
29. Patched Medium · 4.4 The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-31 CVE-2024-8493 Improper Neutralization of Input During Web Page Generation Affects <= 6.6.3 Patched in 6.6.4
30. Patched High · 7.2 The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-07-23 CVE-2024-6931 Improper Neutralization of Input During Web Page Generation Affects <= 6.6.3 Patched in 6.6.4
31. Patched Medium · 4.3 The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events ↗
    2024-07-05 CVE-2024-37518 Cross-Site Request Forgery Affects <= 6.5.1.4 Patched in 6.5.1.5
32. Patched Medium · 4.3 The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access ↗
    2024-05-24 CVE-2024-1295 Missing Authorization Affects <= 6.4.0 Patched in 6.4.0.1
33. Patched Medium · 6.1 The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting ↗
    2024-05-14 CVE-2024-4180 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.0 Patched in 6.4.0.1
34. Patched Medium · 4.3 The Events Calendar <= 6.3.0 - Cross-Site Request Forgery to Notice Dismissal ↗
    2024-04-10 CVE-2024-31433 Cross-Site Request Forgery Affects <= 6.3.0 Patched in 6.3.1
35. Patched Medium · 5.3 The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure ↗
    2024-01-12 CVE-2023-6557 Missing Authorization Affects <= 6.2.8.2 Patched in 6.2.9
36. Patched Medium · 5.3 The Events Calendar <= 6.2.8 - Information Disclosure ↗
    2023-11-20 CVE-2023-6203 Exposure of Sensitive Information Through Data Queries Affects < 6.2.8.1 Patched in 6.2.8.1
37. Patched Medium · 4.3 The Events Calendar <= 6.1.2.2 - Missing Authorization ↗
    2023-07-25 CVE-2023-35777 Missing Authorization Affects <= 6.1.2.2 Patched in 6.1.3
38. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects 4.9.0 - 5.16.4 Patched in 5.16.4.1
39. Patched Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 5.14.0.4 Patched in 5.14.0.4
40. Patched Medium · 6.1 The Events Calendar <= 4.8.1 - Cross-Site Scripting via tribe_paged Parameter ↗
    2019-03-04 CVE-2019-15109 Improper Neutralization of Input During Web Page Generation Affects < 4.8.2 Patched in 4.8.2
41. Patched Medium · 4.7 The Events Calendar < 4.1.1.1 - Open Redirect ↗
    2016-04-25 URL Redirection to Untrusted Site Affects <= 4.1.1 Patched in 4.1.1.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 94 languages, 12 at 90% or more

Plus 70 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-22 700K+ → 600K+ down after 1061 days in tier
2. 2023-08-26 800K+ → 700K+ down after 1362 days in tier
3. 2019-12-03 700K+ → 800K+ up after 428 days in tier
4. 2018-10-01 600K+ → 700K+ up after 304 days in tier
5. 2017-12-01 500K+ → 600K+ up after 267 days in tier
6. 2017-03-09 400K+ → 500K+ up after 342 days in tier
7. 2016-04-01 300K+ → 400K+ up after 169 days in tier
8. 2015-10-15 200K+ → 300K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for The Events Calendar into a readme, a review or a deck. It updates itself.

The Events Calendar: 600K+ active installs, 4.2★ (2,461 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/the-events-calendar