[Plugin: Stout Google Calendar] Stout = Malware – 2 sites hijacked at night

@tburge – I don’t quite know how this plugin can hijack a site. I can assure you this is not malware. I don’t expect you to simply believe that statement so let me try to explain what’s going on.

The plugin takes your Google embed code, parses it with JSON and adds CSS to the head of the calendar that is being displayed. The gcalendar-wrapper.php script is the intermediary between your site and the Google calendar and is the script which appends your CSS styling.

The reason why Google considers it malware, on occasion, is a result of the calendar not being properly shared at some point during the setup and/or use of the Stout Google Calendar plugin. If the calendar is not shared, then Google wants authentication. The authentication ends up being parsed by the intermediary, gcalendar-wrapper.php (which is hosted on your server/ WordPress install.) When this happens, Google sees that the authentication is not originating from their servers and flags it as malware.

If, at any point in the setup and/or use of the plugin, any of your calendars were not shared and an authentication attempt was made, Google will notify the hosting company of the “malware”. Again, the Stout Google Calendar plugin is not malware and does not attempt to hijack sites, etc.

You have access to all the source code so take a look if you like. If you don’t understand the code or it doesn’t matter to you and you are uncomfortable with the plugin, then disable and delete it from your install.

I wrote this plugin to solve a problem for client sites and it still works well, without issue for me and their sites.

Best,
Matt