{
    "title": "The Events Calendar",
    "seo_title": "The Events Calendar: review, settings and limits",
    "h1": "The Events Calendar",
    "description": "The Events Calendar free or Pro: strengths, limitations, pricing, recommended settings and patched vulnerabilities, to decide and set up your calendar.",
    "lead": "The Events Calendar turns WordPress into an events calendar with venues, organizers, Month, List and Day views and iCal export. Our take on the free version and the paid plans, the settings to choose at install time and the SQL flaws worth knowing.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:06:55+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/the-events-calendar/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/the-events-calendar/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/the-events-calendar/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/the-events-calendar/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/the-events-calendar/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "The Events Calendar",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/the-events-calendar/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/the-events-calendar/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/the-events-calendar/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "The Events Calendar"
        },
        {
            "level": 2,
            "text": "What The Events Calendar does on your site"
        },
        {
            "level": 2,
            "text": "Which sites The Events Calendar suits best"
        },
        {
            "level": 2,
            "text": "Strengths and limitations of The Events Calendar"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend for The Events Calendar"
        },
        {
            "level": 2,
            "text": "The Events Calendar security: three unauthenticated SQL injections"
        },
        {
            "level": 2,
            "text": "Frequently asked questions about The Events Calendar",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for nonprofits, venues and clubs that publish a public calendar and update it often.\n- Main caveat: recurring events, series and Week or Map views require Pro.\n- Free; Pro costs $399 a year with recurrence, commission-free tickets and automatic imports.\n\n## What The Events Calendar does on your site\n\nThe Events Calendar adds an Event post type to WordPress, with venues and organizers you enter once and reuse, plus event-specific categories and tags. Visitors browse the calendar in Month, List or Day view, search for events, and add them to Google Calendar or export them as iCal. Every event page gets JSON-LD [structured data](https://www.wp-masquerade.com/glossary/structured-data/), and the plugin ships blocks for the editor, Elementor widgets and REST API routes.\n\nA CSV import tool is included. Everything else comes from separate add-ons that run on top: Events Calendar Pro (recurring events and series, Week, Photo and Map views, shortcodes, custom fields, event duplication), Event Aggregator (automatic imports from Google Calendar, Meetup, Eventbrite or an iCal feed), Filter Bar, and Community Events for visitor-submitted events. Ticketing runs through Event Tickets, a separate free plugin (RSVPs and tickets), with Event Tickets Plus for selling through [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/).\n\nListed on wordpress.org since 2010, the plugin now belongs to Liquid Web (part of Nexcess), which also sells LearnDash, Give and Kadence. The pricing page offers two annual plans, Pro at $399 and Elite at $599; Elite adds seating maps and email campaigns.\n\n![Diagram: The Events Calendar works on visitors and bots, wordpress, database and files. Public traces: branded HTTP header (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); REST routes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/events-calendar/diagram-en.svg?v=422684c3)\n\n## Which sites The Events Calendar suits best\n\nThe Events Calendar makes sense when the calendar is a real section of your site that you update often:\n\n- **Nonprofits, performance venues, cultural spaces and restaurants**: a public calendar where each venue and organizer is entered only once.\n- **Sites that rely on Google to fill their events**: JSON-LD markup is generated for every event without any setup.\n- **Organizers who want to sell or reserve seats on their own site**: Event Tickets plugs into the calendar, with no outside ticketing platform.\n- **Schools, clubs and local governments**: visitors add dates to their own calendar through the iCal and Google Calendar export.\n\nIt is the wrong tool for appointment scheduling or time-slot booking, which call for a booking plugin. It also falls short if you need several independent calendars on one site.\n\n## Strengths and limitations of The Events Calendar\n\n### Strengths\n\n- **A complete free core.** Month, List and Day views, venues, organizers, search, CSV import and iCal export at no cost.\n- **Structured data out of the box.** Events are marked up in JSON-LD, which helps Google show them in its results.\n- **Highly customizable.** Partial template overrides in your theme, a skeleton stylesheet, template tags, and documented hooks and filters.\n- **One vendor, one ecosystem.** Ticketing, automatic imports, filters and visitor submissions plug in without switching tools.\n\n### Limitations\n\n- **Recurring events cost extra.** Recurrence, series, Week, Photo and Map views and shortcodes all require Events Calendar Pro.\n- **One calendar per site.** To separate audiences, you have to rely on categories or tags.\n- **Slow free support.** The team says it checks the wordpress.org forum about once a week; priority support is for paying customers.\n- **Recent serious vulnerabilities.** Three SQL injections exploitable without an account were patched in 2024 and 2025.\n- **Google Maps on by default.** Event and venue pages load a Google map, which should sit behind consent collection.\n\n## The settings we recommend for The Events Calendar\n\nAll of these settings exist in the current free version, under Events > Settings.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Events URL slug**  Events > Settings > General, Viewing section | A word that fits your site (events, calendar), set before you share the address | The default is `events`; changing it later changes every calendar URL. |\n| **Include events in main blog loop**  Same section | Off (default) | Events stay in the calendar instead of mixing with your blog posts. |\n| **Enable the Month View Cache**  Same section | On (default) | The Month view HTML is cached, which speeds up a busy calendar. |\n| **Move to trash events older than**  Events > Settings > General, Maintenance section | Disabled if past events serve as an archive, otherwise 1 year | Past events go to the trash, where you can still restore them. |\n| **Permanently delete events older than**  Same section | Disabled (default) | Permanent deletion cannot be undone: the trash plus a backup is enough. |\n| **Debug mode**  Events > Settings > General, Debugging section | Off (default) | It is meant for troubleshooting with the Debug Bar plugin and has no place on a live site. |\n| **Show comments**  Events > Settings > Display > Calendar | Off (default) | Comments under every event mostly attract spam. |\n| **Default view**  Same screen | List if you publish few events, Month otherwise | A nearly empty month grid makes the calendar look abandoned. |\n| **Enable Maps**  Events > Settings > Display > Maps | Off with no physical venues; otherwise on, behind a consent banner | The Google map loads on every event and venue page. |\n\nIf you keep maps on, a consent plugin such as [Complianz](https://www.wp-masquerade.com/features/camouflaged-plugins/complianz/) can block Google Maps until the visitor agrees.\n\n- Open the calendar URL in a private window: it should load in the view you chose, styled by your theme.\n- Run an event page through Google’s Rich Results Test: an Event item should be detected.\n- With maps on, reload a venue page without accepting cookies: no request should go out to Google Maps.\n- In Plugins, check that The Events Calendar and its add-ons (Pro, Event Tickets) are all up to date.\n\n## The Events Calendar security: three unauthenticated SQL injections\n\nThe plugin’s most serious flaws are [SQL injections](https://www.wp-masquerade.com/glossary/sql-injection/) that an anonymous visitor can exploit, which makes them easy targets for bots:\n\n- **CVE-2024-8275, fixed in 6.6.4.1**: SQL injection through the `order` parameter of the `tribe_has_next_event` function, no account needed (CVSS 9.8, critical).\n- **CVE-2025-9807, fixed in 6.15.1.1**: time-based SQL injection through the `s` search parameter, no account needed, allowing data to be read from the database (CVSS 7.5).\n- **CVE-2025-12197, fixed in 6.15.10**: the same `s` parameter stayed exploitable from 6.15.1.1 to 6.15.9, showing the first fix was incomplete (CVSS 7.5).\n\nThe vendor has shipped many hardening releases since then, as recently as October 2026. What helps: turn on automatic updates for the plugin and its add-ons (see our guide to automatic plugin updates) and follow published advisories (see monitoring your plugins for vulnerabilities). WP Masquerade Pro removes the plugin’s branded HTTP header, its folder and its script IDs, but its `tribe-*` classes and its REST route stay visible: masking makes the plugin harder to spot without replacing updates.\n\n## Frequently asked questions about The Events Calendar\n\n**Does the free version handle recurring events?**\n\nNo. Recurring events and series are part of Events Calendar Pro, and the pricing page lists them in the Pro and Elite plans. On the free version, you create each date by hand.\n\n**Can you sell tickets with The Events Calendar?**\n\nYes, with the free Event Tickets plugin, which adds RSVPs and tickets. The pricing page presents no ticket commission fees, WooCommerce integration and QR code check-in as benefits of the Pro plan.\n\n**How much does the paid version cost?**\n\nThe plan page shows Pro at $399 per year and Elite at $599 per year, without stating a number of sites. Liquid Web also sells a $350-per-year single-site bundle that combines The Events Calendar, LearnDash, Give and Kadence.\n\n**Can you import events from Google Calendar or Eventbrite?**\n\nCSV import is free. Automatic imports from Google Calendar, Meetup, Eventbrite or an iCal feed rely on the Event Aggregator service; the pricing page includes event importing in the Pro plan, capped at 200 imports per day.\n\n**Can one site have several calendars?**\n\nNo, according to the vendor’s FAQ. Sort events by category instead and share the URL of a filtered view; with Pro, shortcodes display a filtered calendar inside a page.\n\n## Key facts\n\n- Category: Utilities\n- Vendor: Liquid Web\n- Price: Free; Pro plan at $399 per year and Elite at $599 per year\n- Active installations (wordpress.org): 600 000+\n- Version: 6.18.3\n- Official page: https://wordpress.org/plugins/the-events-calendar/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: branded HTTP header, folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes, REST routes",
    "catalog": "events-calendar",
    "essentials": [
        "Best for nonprofits, venues and clubs that publish a public calendar and update it often.",
        "Main caveat: recurring events, series and Week or Map views require Pro.",
        "Free; Pro costs $399 a year with recurrence, commission-free tickets and automatic imports."
    ],
    "format": "application/json"
}