Changelog

Every release of WebCalendar for WordPress, documented. Latest version: 1.4.5, released October 27, 2026. Looking for the firewall instead? Its releases are on the Agent Firewall changelog.

Looking for the standalone PHP app instead? That is a different program — the classic WebCalendar 1.9, still at k5n.us/webcalendar. If you run one and want it inside WordPress, see the WebCalendar 1.9 migration guide.

Install WebCalendar — Free on WordPress.org

1.4.5 — October 27, 2026

Fixes sites where no event could be saved because a database server’s index limit stopped the events table being created. Updating creates it; categories and settings are kept.

Fix: On some hosts no event could be saved (“Table … webcal_entry doesn’t exist”). Some database servers limit how long an index can be, and the table events are stored in used one that was too long, so it was never created. Updating now creates the missing table automatically; your categories and settings are kept.
Fix: If WebCalendar cannot create one of its database tables, it now says so. Administrators see a notice naming the table and the database’s reason, and WebCalendar retries every hour, instead of failing later when you save an event.
Fix: wp webcal event list could print events out of date order on some databases (seen on MariaDB 10.4). Events are now always returned sorted by date and time.
Requires craigk5n/webcalendar-core 4.17.3, which carries the date-order fix.

1.4.4 — October 24, 2026

A security release, following a full security review of the plugin. Please update. Imported calendars could change other users’ events, pending events showed before approval, and contact details, private events and email addresses were readable by people who should not see them.

Security: Imported calendars could change or delete other users’ events. An iCal file or a subscribed remote calendar that reused another event’s ID could overwrite that event, take it over, or delete it. An import now only touches events on the calendar it imports into.
Security: Event titles from imported files and remote calendars could run script on the event’s page and in site search results. Titles are now shown as plain text, and markup is removed on import.
Security: Events awaiting approval were visible before approval through the iCal feed, a direct link to the event, its single event page and the sitemap. They now stay hidden until approved, everywhere.
Security: A shared calendar not marked public showed its private events to any logged-in user who asked for it. Its Private and Confidential events are now shown only to the calendar’s admin and to users who manage shared calendars.
Security: The user search let Subscribers work out anyone’s email address. It now searches email addresses only for users allowed to list users.
Security: Deleting an event left its registrations behind for the next new event. That event could open for sign-ups by itself, and a guest’s name and email could be sent to its author. Deleting an event now removes everything that belonged to it.
Security: A new account with a deleted user’s username took over that user’s events. Calendar data now goes to whoever you choose when deleting the user, or is kept under a placeholder no one can sign up as.
Security: Single requests could tie up the server. Asking for events far in the future, or opening an event’s page for a date centuries away, made WebCalendar work out every repeat in between. The event list, event pages and the AI tools now refuse such dates.
Security: Venue and organizer contact details (address, phone, email) were readable by anyone. Full records are now limited to the users who manage them; the public list still shows names.
Security: Event descriptions written by Subscribers or remote calendars could run any shortcode on your site. Shortcodes now run only in descriptions written by Authors and up.
Security: CSV exports could carry spreadsheet formulas typed into an event or a registration. Such cells are now written as text.
Security: Password-protected events from The Events Calendar were imported as public events. They are now skipped.
Security: An uploaded WebCalendar 1.9 export stayed in the public uploads folder if a migration was abandoned. It is now kept privately and removed after an hour.
Security: The AI settings page’s test showed how many private events other users had, the RSVP limit could be exceeded by sending requests at the same time, and other pages’ traffic could use up the RSVP limit. All fixed.
Fix: Exporting events that have tags failed in 1.4.3 (single-event export, bulk export and subscription feeds). Fixed.
Fix: Imported calendars now hide every occurrence they mark as deleted. iCal files can list several deleted dates of a repeating event on a single line. WebCalendar used to ignore that line when importing or syncing a calendar, so those occurrences came back.
Fix: RSVP: one registration can hold at most 10 places; a canceled or refunded registration no longer checks in at the door; someone who registers twice is emailed about it at most once a day; and the privacy eraser now removes the guest from the attendee list and the activity log too.
Fix: Undoing an import, or ending a trial of The Events Calendar sync, could delete a later event of another user. It now removes only events the import created.
Fix: One unusual event in The Events Calendar could stop the sync for everyone, leaving events that had been removed there still showing here. That event is now skipped and reported, and the rest sync.
Fix: Queued email could be lost when two messages were sent at the same moment.
Fix: “Delete Data on Uninstall” now removes everything, including subscription links and queued email.
Requires craigk5n/webcalendar-core 4.17.2, which carries the import fixes.

1.4.3 — October 23, 2026

You can now delete one occurrence of a repeating event without losing the series, and deleted and moved occurrences carry through iCal export, import and subscriptions.

Fix: You can now delete just one occurrence of a repeating event. Deleting an occurrence from the calendar popup used to remove the entire series. It now asks whether you mean only this occurrence or the entire series, the same way editing does, with the single occurrence chosen by default. Editing one occurrence also gives you a “Delete This Occurrence” button.
Fix: Editing only one occurrence of a repeating event left the original in place. The edited copy appeared next to the unchanged original instead of replacing it. Now it replaces it.
Fix: Deleted and moved occurrences now carry over through iCal export, import and subscriptions. Exported .ics files and calendar subscriptions used to leave out deleted occurrences, so they still showed up in Google Calendar, Outlook and Apple Calendar, and the repeat rule was written in a form those apps could not read. Importing a calendar now honors deleted, moved and canceled occurrences too. Syncing a remote calendar in which one occurrence had been moved could also overwrite the whole series with that single event; it no longer does.
Bumped craigk5n/webcalendar-core to ^4.17.0, which carries the repeating-event fixes.

1.4.2 — October 15, 2026

Free trials now unlock the plan you are trying, Upgrade links no longer lead to a missing page, and a paid plan can no longer be switched on by editing a setting.

Fix: Starting a free trial now unlocks the plan you are trying. A trial gave you the paid plugin, but its paid features stayed switched off for the whole 14 days, as if you had not started one. A Starter, Business or Agency trial now gets exactly that plan’s features.
Fix: Upgrade links no longer lead to a missing page. When the plugin could not get a checkout link from Freemius, its “Upgrade” links pointed at a page that does not exist. They now open the WebCalendar product page with the plans and prices.
Security: A paid plan can no longer be switched on by editing a setting. On the paid edition, paid features could be turned on without a license by changing a database option, and the developer testing switch worked on any site with debugging enabled. Both now require a real license, or a local development site for the testing switch.

1.4.1 — September 30, 2026

Category colors are back on the admin calendar, Quick View and event pages follow your date and time formats, and “+ Add Event” opens the form straight away.

Fix: Category colors were missing from the admin calendar, and the Quick View popup said “Default” for every event. An event assigned to a category showed in the default blue rather than its category’s color, and clicking it named the category “Default”. The admin calendar had stopped loading your category list — a call dropped in a February 2026 change — so nothing could match an event to its category. The Edit Event screen fetches categories separately and was always correct, which is why the problem looked confined to the popup. Both are fixed: events show their category color again, and Quick View names the right category. Thanks to hanswilli for the report and for narrowing it down so precisely.
Fix: The Quick View popup and the event page ignored your Date Format and Time Format settings. The popup always showed dates like “2026.09.26 03:00 pm”, and the event page always used English 12-hour times, whatever you had chosen. Both now follow your settings, in the public and admin calendars, and month names follow your site language. Leaving Date Format blank now uses your WordPress date format (Settings → General). Thanks to hanswilli.
Fix: “+ Add Event” on the public calendar now opens the event form straight away. It used to drop you on the admin calendar, where you had to press “+ Add Event” again and then find your way back. The form now opens on the day you were looking at, and saving or cancelling returns you to the calendar page you started from. Thanks to hanswilli.
Fix: The free edition no longer writes “Failed to open stream” warnings to your error log on every page load. It was looking for paid-only files that are not part of the wordpress.org download. Nothing was broken and visitors never saw it. Thanks to hanswilli.

1.4.0 — September 27, 2026

Manage events from the command line, check an installation with wp webcal doctor, and let AI assistants work with venues, organizers and registration.

New: Manage your calendar from the command line. wp webcal event list|get|create|update|delete works on one event at a time, alongside the bulk import and export commands that were already there. Useful for scripts, scheduled jobs and anything automating a site.
New: wp webcal doctor checks an installation and tells you what is wrong with it — missing database tables, scheduled jobs that are not running, whether the site can still reach WordPress.org for updates, mail sitting unsent, and settings that contradict each other. Each line says what it found rather than just pass or fail.
New: AI assistants can now work with venues, organizers and event registration. Previously they could only see events, categories and users. An assistant can now list your venues and organizers, attach one to an event, and — on the Starter plan and up — check how full an event is and who has registered.
New: AI assistants can ask the site how it is set up before creating anything: your timezone, which fields an event has, and what the settings mean. Less guessing, fewer wrong answers.
New: Creating an event can now be made safe to retry. If an assistant or script loses its connection and tries again, it no longer leaves a duplicate behind.
Security: The AI “calendar info” tool revealed how many private events other people had. It reported a count of every event on the site, so anyone who could view the calendar — which includes Subscribers — could learn how many Private and Confidential events other people were keeping. Only the number was exposed, never any event’s contents. The count now follows the same rules as everything else: your own events, plus other people’s only where you are allowed to see them.
Fix: Shared and remote calendars chosen as participants were silently dropped when an event was saved. They are now kept.
Fix: wp help webcal <command> showed nothing for any command. All of them now document themselves.
Fix: AI tool descriptions now say what the tools actually do — most importantly that deleting or updating a repeating event affects the whole series, not one occurrence.

1.3.0 — September 21, 2026

Event registration: visitors sign up for an event with double opt-in by email, and you get an attendee list, a spreadsheet export and check-in from your phone. Starter plan and up.

New: Let visitors register for your events. Turn on Registration for any event, set how many places there are and when sign-ups close, and add the form to a page with [webcalendar-rsvp event=”123″]. People enter a name and email, confirm from a link we email them, and get a link of their own to release their place if they cannot come. You see who is coming, export the list as a spreadsheet, and tick people off on arrival from a phone. Starter plan and up.
A place is only held once someone confirms from their email. Until then the event is not counted as any fuller, which is what stops an automated script filling every seat on a public form. It also means a busy event can fill up between someone signing up and confirming — they are told so plainly.
Registering an address that is already on the list tells that address, not whoever typed it in. Nobody can use the form to find out whether a particular person is attending.
Tick people off as they arrive straight from the attendee list, as well as from the check-in page on your phone.
Fix: On WordPress 6.6 the event editor was partly unusable. The pop-up for adding or editing an event opened underneath the admin menu, so the left edge of it could not be clicked. WordPress ships the stylesheet for its own interface controls, and newer versions load it automatically — 6.6 does not, and the plugin was relying on that. It now asks for the stylesheet itself. Only affects sites on WordPress 6.6.
Bumped craigk5n/webcalendar-core to ^4.16.0. Required, not optional — it carries two fixes registration cannot work without.

1.2.1 — September 15, 2026

A security release. Two ways a private event could be seen by someone with no claim on it — a subscription link that outlived the account behind it, and the message you get when an event clashes with somebody else’s.

Security: A calendar subscription link belonging to a deleted WordPress user returned everyone’s private events. Subscription links carry a personal token instead of a login, because calendar apps cannot sign in. If the WordPress account behind a link had since been deleted, the feed stopped limiting itself to public events and served every user’s Private and Confidential events — full titles, descriptions and locations — to anyone holding that address. A link whose account no longer exists now returns public events only. Present in 1.1.x and 1.2.0. If you have ever deleted a WordPress user who had generated a calendar subscription link, update — and revoke the subscription links of people who have left, since updating does not invalidate a link already saved in someone’s calendar app.
Security: A scheduling conflict no longer reveals what the other person’s appointment is. Saving an event that clashed with someone else’s returned that event in full — title, description, location — whatever its privacy setting, so trying to book a colleague’s time disclosed the contents of their private appointments. The clash is still reported, with the same times, but an appointment you have no permission to see now shows only as “Busy”. Public events, your own, shared calendars you subscribe to, and administrators with full visibility are unchanged.
Fix: An event canceled in The Events Calendar no longer stays on the mirrored calendar as though it were going ahead. Canceling in The Events Calendar keeps the event published, so the sync had nothing to react to; it now carries the canceled status across.
Bumped craigk5n/webcalendar-core to ^4.15.0. Required, not optional — the plugin will not run on older versions. Every path in the library that reads events, tasks or journals now takes a scope object saying who is asking, and the unfiltered query has to be requested by name instead of being what you get by leaving arguments out. That inverted default is what produced both of the leaks above. Nothing about what your calendar displays changes.

1.2.0 — August 17, 2026

Move a whole calendar over from The Events Calendar — or run both side by side first — plus tags, custom fields, venues and organizers, online events, and two security fixes.

Security: Private and Confidential events could be read by people who should not see them. Anyone visiting a public calendar page could download every private event — titles, descriptions and locations — through the iCal export link, and any Subscriber-level account could export the whole calendar as a spreadsheet. The AI assistant’s “get event” tool returned any event by number with no permission check, and WordPress site search listed private event titles and description excerpts to logged-in visitors when single event pages were set to “all”. All are fixed, and the permission check now runs in one shared place that every path returning events goes through. Update if your calendar holds private events and is publicly visible or allows registration.
Security: Event attachments are now validated before being saved. An attachment could previously carry a hand-crafted web address that was stored as-is and turned into a link on the public event page, which allowed a javascript: address from anyone able to edit an event. Addresses are now restricted to ordinary http/https links and anything unrecognized is discarded.
Added: Move your calendar over from The Events Calendar in one confirmed step — events, venues, organizers, categories, tags, featured images and recurring rules. The Events Calendar’s own data is never modified, re-runs never duplicate, and every import can be undone. WP-CLI: wp webcal migrate tec.
Added: Not ready to switch? Run WebCalendar side by side with The Events Calendar on a schedule and compare with live data. Strictly one-way — The Events Calendar wins and its data is never modified. End the trial by switching over, or remove everything in one click. WP-CLI: wp webcal sync tec.
Added: A Filter Bar on the calendar. Visitors can narrow events by tag, and by venue or organizer (Starter and up). Filtering happens on the server, so it applies to the whole date range rather than just what is on screen. Each control only appears when your site has something to pick. Hide it with .
Added: Tags on events — any number of free-text, site-wide labels alongside the single color-coded category. Suggestions as you type, and matching ignores case so “Outdoors” and “outdoors” stay one tag. Exposed on the REST API, with GET /webcal/v1/tags listing them all.
Added: Online and hybrid events — add a meeting URL and platform name (“Zoom”, “Google Meet”). Separate from Location, so an event can be in person, online, or both, and its page shows a “Join online” link. Rides on the REST API as conference_url and conference_label.
Added: Custom event fields — define your own fields under Calendar → Custom Fields and fill them in on every event. Text, long text, link, email, number, date, yes/no, or a drop-down of your own choices. Two fields whose labels boil down to the same stored name are kept apart automatically. Migrated from WebCalendar 1.9? “Find fields in existing data” reads your old field definitions back out of the data that came across.
Added: A Venues & Organizers screen under the Calendar menu — add, rename and edit them in one place, see how many events each one holds, and when you remove one, choose where its events should go. Event pages now describe their venue to search engines, including its address and map coordinates.
Improved: Duplicate now copies the whole event immediately — repeat pattern, participants and their responses, category, reminder, location, venue, organizer, attachments, featured image and custom field values. Previously it only pre-filled the form and quietly lost everything not shown on screen.
Fix: Editing an event no longer erases its venue, organizer, online meeting link or featured image. Editing one occurrence of an all-day repeating event also no longer turns the whole series into a timed one.
Fix: Editing an event that was awaiting approval no longer publishes it. The “awaiting approval” flag was cleared by any edit, putting submissions on the public calendar with nobody approving them.
Fix: The calendar interface can now actually be translated. Every string was listed in the translation catalog but could never load in the browser, so translations had no effect and nothing reported a problem.
Fix: Deactivating the plugin now stops its scheduled background jobs (reminders, email queue, calendar sync), and choosing to delete all plugin data when uninstalling now removes every table the plugin created — six were being left behind.
Fix: The category legend no longer breaks for logged-out visitors, the event-page map renders again at the venue’s exact coordinates, month view’s day-of-week headings no longer misalign when the week starts on a day other than Sunday, and the events REST API no longer omits recurring occurrences later in the day on the last requested date.
Bumped craigk5n/webcalendar-core to ^4.10.0.

1.1.6 — August 3, 2026

AI tool calls become visible to security plugins, plus CLI import fixes and a large-export fix.

Security: AI/MCP tool calls now run through the WordPress Abilities API, so security and agent-governance plugins can see, audit, and block them. Previously such plugins saw only an opaque API request and could not enforce policies like “deny deletes”. Tool calls also gain the ability’s own input and output validation. (WordPress 6.9+ — older versions keep the previous behavior.)
Added: wp webcal import --update-existing — re-importing an iCal file from the command line can now update events that already exist (matched by UID) instead of skipping them, matching what the admin Import screen and remote calendar sync already do. Off by default; the summary reports imported, updated, and skipped counts separately.
Fix: wp webcal import now actually imports CSV files. It previously parsed every file as iCal, so a CSV reported “Imported 0 events” without importing anything. CSV files from Google Calendar and Outlook are detected automatically; other layouts can supply a column map. The admin Import screen was never affected.
Fix: wp webcal export no longer fails on calendars with roughly 65,000 or more events (“Prepared statement contains too many placeholders”).
Fix: Event titles and descriptions containing emoji could fail to save with an “Incorrect string value” database error on sites whose wp-config.php sets DB_CHARSET to utf8 (the WordPress sample-config default). The plugin’s database connection now upgrades to utf8mb4 exactly as WordPress core does.
Improved: A new FAQ explains how to restrict your Google Maps API key in Google Cloud Console so a copied key cannot bill against your account.
Bumped craigk5n/webcalendar-core to ^4.3.10 (large-export fix and duplicate-id hardening for the batch loaders).

1.1.5 — July 25, 2026

Large WebCalendar 1.9 migrations without touching PHP upload limits, a compact calendar filter, and a batch of display fixes.

Added: Import a large WebCalendar 1.9 export without raising PHP upload limits. Drop the .sql file into wp-content/uploads and choose the new “Import a file already on the server” option, which bypasses upload_max_filesize and post_max_size entirely. The file is deleted after a successful import.
Added: A wp webcal migrate <file.sql> WP-CLI command imports a legacy export straight from disk — no HTTP upload limit at all. Supports user mapping, account creation, selective includes, and --dry-run.
Changed: The calendar filter is now compact dropdowns instead of a long row of checkboxes. A “Categories” button — and a separate “Layers” button when the calendar has subscribed calendars — each opens a searchable panel with colored checkboxes and Select all / None. Printing still shows a static color key.
Changed: Clearer “file too large” errors on the import pages. The message now names your current upload_max_filesize and post_max_size and explains how to raise them, plus the two no-config alternatives above.
Fix: Subscribed-calendar layers can now be toggled on the frontend. They were rendered as a static legend with a pointer cursor but no control, so their events were always visible.
Fix: Imported global holidays now appear on every calendar. They were stored under a shared holidays calendar that user-filtered calendar pages excluded, so they showed only in the admin console — and they now carry their Holiday category correctly.
Fix: Event categories now display for everyone, not just the event’s owner. Category assignments were read as the viewing user, so an event created by one user looked uncategorized to every other visitor and matched nothing in the category filter. They are now read as the event’s creator.
Fix: The month view no longer shows a stray trailing week belonging entirely to the next month.
Fix: A single corrupt recurring event no longer blanks the whole calendar. An unparseable recurrence rule made the events feed return a 500, so nothing rendered; such an event is now skipped and logged, and the rest of the calendar loads.
Fix: WebCalendar 1.9 migration hardening — events deleted in the legacy calendar are no longer imported, reminder rows no longer trigger a fatal error, recurrence data is sanitized, and a migration that fails partway now removes the WordPress accounts it created for that run.
Fix: The AI page’s “Try It” test reported 7 MCP tools instead of 8. The count is now derived from the live tool registry. Only the admin test panel was affected — AI clients were never given a tool count.

1.1.4 — July 24, 2026

Migrate a standalone WebCalendar 1.9 install, and AI/MCP integration becomes free on every edition. Version numbers now line up with the paid edition, so this release follows 1.0.8.

Added: Migrate from a standalone WebCalendar 1.9 installation. Upload an export from WebCalendar’s “Export for WordPress” page (or a plain mysqldump of the webcal_* tables) under Import → WebCalendar 1.9, map each legacy user to a WordPress account — or create new accounts, which receive password-setup emails — choose what to bring over, and import. Event times convert from legacy GMT storage to your site time zone, re-importing the same file is a no-op, and every run can be undone. The file is parsed, never executed, and password hashes are never imported.
Added: AI/MCP integration is now free on every edition, including the WordPress.org build. It previously required a Starter license. Connecting an AI assistant to your calendar is a core feature, not an upsell.
Added: A webcalendar_list_users MCP tool. Event filters and participant fields take logins, but assistants had no way to discover them; this read-only tool returns WordPress users plus shared and remote calendars, matching the admin participant picker.
Added: AI read-only mode (Settings → AI Read-Only Mode) restricts assistants to viewing calendar data — the create, update, and delete tools are hidden from tool discovery and rejected if called. Off by default.
Added: The MCP endpoint now accepts a WordPress Application Password as a Bearer token as well as Basic auth, so clients that can only send a Bearer token — including Claude’s API connector — can connect.
Changed: AI access is administrators-only by default. A new “AI Access” setting opens it to all calendar users, each scoped to their own permissions.
Changed: MCP tool names are now snake_case (webcalendar_list_events) instead of the slash form, because / is not valid in a tool name under the function-name rules AI clients enforce. The old names still work when calling a tool, so existing connections keep working.
Changed: The free edition is now generated from the same single codebase as the paid editions, replacing the separately maintained free plugin. The WordPress.org build contains no locked or premium code, and a release gate verifies that on every release.
Changed: Conflict detection, external calendar subscriptions, front-end event submission, and category merge are now paid-edition features. They were available free during the launch period.
Fix: Settings no longer shows features your plan does not include as switched on.
Fix: The hourly remote-calendar sync no longer triggers a fatal error on installs that do not ship the sync service.

1.0.8 — July 20, 2026

Subscribed calendars now pick up upstream edits, re-importable iCal files, and a time-zone warning that heads off a whole class of import bugs.

Added: Remote calendar sync now updates events that changed upstream. A subscription previously handled additions and deletions only, so an event edited on the remote calendar — moved to a different time, renamed — kept its stale values indefinitely.
Added: iCal import can now update events you have already imported, via an opt-in “Update events that have already been imported” checkbox. Off by default, so re-importing the same file still changes nothing and local edits are never overwritten unexpectedly. The summary reports how many events were updated.
Added: A warning when your site time zone is set to a fixed UTC offset (for example “UTC-5”) rather than a city. A fixed offset cannot observe daylight saving time, so imported events land an hour off for part of the year — and correcting the setting afterwards does not repair events already imported. Shown on the Import, Remote Calendars, and Settings pages, and as a Site Health test.
Fix: Week view now shows events on the last day of the week for visitors in time zones ahead of UTC. The calendar requested a range that ended a day early after converting to UTC, which could hide the final day’s events — most visible when a whole week appeared empty.
Updated the webcalendar-core engine to ^4.3.7: category changes re-sync on update, all of an event’s categories survive an import instead of only the last one, and an escaped comma in a category name no longer splits it in two.
Updated the bundled iCalendar library to 1.2.0. Lenient parsing no longer substitutes the current time for a date it cannot read — an empty or garbage start date is now reported and skipped instead of silently becoming “now.”
Tested up to WordPress 7.0, now part of the CI matrix alongside 6.6, 6.7, and 6.9.

1.0.7 — June 30, 2026

Sharper imports, wider holiday coverage, and three data-and-display fixes.

Added: The Import page now shows collapsible “Supported fields” reference tables for both the iCal and CSV tabs, so you can see which properties are recognized without leaving the page.
Fix: Global holiday import (Nager.Date) now imports the current year plus the next two years in a single operation, instead of only the current year.
Fix: The calendar now respects the WordPress “Week Starts On” setting (Settings → General) for month and week views.
Fix: Shortcodes in event descriptions are now expanded when displaying events on single-event pages and in the REST API response.
Fix: Thunderbird holiday provider URLs corrected — files are now fetched from the correct location with the correct filename prefixes.

1.0.6 — June 27, 2026

Broadens hosting compatibility.

Fix: Lowered the minimum PHP requirement from 8.2 to 8.1. The distributed build already passes PHP 8.1 syntax checks, so the previous constraint was unnecessarily blocking installs on hosts running PHP 8.1.

1.0.5 — June 4, 2026

Completes the iCal time-zone import fix from 1.0.4. If you import .ics calendars — especially if you imported on 1.0.4 and saw times off by an hour — update now.

Fix: iCal import time-zone conversion now actually runs. 1.0.4 shipped the core fix but did not pass the site time zone to the importer, so UTC and zoned times were still stored verbatim and imported events appeared shifted by the UTC offset (for example, one hour during British Summer Time). The site time zone is now wired into the importer, so imported events land at the correct local time and day.

1.0.4 — June 4, 2026

Fixes imported iCal events appearing at the wrong time when the source file uses UTC or a different time zone.

Fix: iCal import now preserves event times across time zones. DTSTART/DTEND TZID values are forwarded on import, and UTC or zoned times are rebased to the calendar’s time zone, so imported events no longer appear shifted by several hours.
Updated the webcalendar-core engine to ^4.3.4, which includes the EventMapper time-zone import fixes.

1.0.3 — May 12, 2026

Critical fix for plugin activation on shared hosting, plus admin form save fixes. Strongly recommended.

Fix: Database connections now parse DB_HOST the same way WordPress core does — bare localhost resolves to a Unix socket, matching shared-hosting environments. Resolves the “Can’t assign requested address” error reported on plugin activation.
Fix: Activation no longer aborts on database connection errors — initial data seeding (categories, holiday calendar, layer subscriptions) retries automatically on the next admin request.
Fix: REST API validators for optional numeric fields now accept empty values as “not provided” instead of returning HTTP 400. Resolves admin form save failures when no category was selected.
Fix: The REST owner validator accepts the global-owner sentinel used by categories and nonuser calendars.
Testing: New E2E lane runs every test with WP_DEBUG enabled and fails on any plugin-originated PHP notice, warning, deprecation, or fatal — 39 critical-flow specs covering activation, REST write paths, and rendering.
Testing: New socket-only MySQL activation lane reproduces the WordPress.org reviewer environment end-to-end as a regression guard.

1.0.2 — April 21, 2026

Security hardening across REST, uploads, and outbound HTTP.

Security: Remote-calendar sync and webhook delivery now block private-IP and cloud-metadata destinations (SSRF hardening).
Security: Admin file uploads (CSV and iCal import) now route through WordPress’s upload handler with an explicit MIME allowlist, and temporary uploads are cleaned up after processing.
Security: Added direct-file-access guards to all directory index stubs.
Security: REST export-route nonce inputs are sanitized before verification.
Security: All 23 REST write endpoints across 8 controllers now declare explicit argument schemas with per-field sanitization and validation.
WP-CLI import/export commands now use the WordPress Filesystem API instead of raw file I/O.
Fix: The popup “View Event Details” link works with emoji event titles.
1,038 automated tests (+23 new regression guards), PHPStan Level 9, zero coding-standards errors on changed code.

1.0.1 — March 9, 2026

WordPress.org review compliance plus several frontend fixes.

Fix: Single event pages now display the participant list.
Fix: The frontend calendar fetches all pages of events, fixing missing events on busy days.
Fix: Recurring event detail pages show the correct occurrence date.
Plugin slug changed to agenticdaisy-calendar per WordPress.org review.
Added external-service disclosures (OpenStreetMap, Google Maps, social sharing, add-to-calendar).
Bundled Leaflet locally instead of loading from a CDN.
WordPress Plugin Check: zero errors.
1,126 automated tests, PHPStan Level 9, 86%+ coverage.

1.0.0 — March 5, 2026

Initial release — a full-featured calendar plugin, free, with no license gating.

Full calendar admin UI with month, week, and day views.
Event CRUD via REST API with full RFC 5545 recurring event support.
Categories with color coding and layer-based calendar filtering.
iCal import/export and remote calendar subscription with automatic sync.
[webcalendar] shortcode and Gutenberg blocks (Calendar, Upcoming Events).
Single event pages with SEO-friendly permalinks and Schema.org JSON-LD.
Open Graph and Twitter Card meta tags, social share buttons, and “Add to Google/Outlook/Yahoo” one-click buttons.
Global holiday management with standard US holiday import.
Conflict detection with “Save Anyway” option for overlapping events.
Email notification system with invitation templates and reminders.
Role-based access control with 36 granular capabilities.
REST API rate limiting and event pagination with safety caps.
1,126 automated tests, PHPStan Level 9.

Stay Up to Date

WordPress notifies you of updates automatically from your admin dashboard. You can also follow @agenticdaisy on X for release announcements, or view this changelog on WordPress.org. Found a security issue? See our security policy.