Security: add_query_arg() need escaped

Hi, thanks for pointing out the potential vulnerability, we take security very seriously. Fortunately this is a false alarm, we purposefully left the code this way.

There’s two reasons for this. Firstly, we supplied get_home_url() as the base link, which is where the vulnerability could come from were we not to supply one. See mention of this here – https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/ – since get_home_url() provides a clean URL, it’s safe to use.

Furthermore, that variable is output to the screen further down the line in the calendar templates, and they both use esc_url when printing that value so it’s escaped in the end.

We will for overabundant precaution however look at cleaning that url with esc_url_raw in the next update.

We appreciate the heads up regardless, however in the future if you do discover a security vulnerability, please contact us directly. In the event of a real vulnerability we should have the chance to push out an update before it’s out in the open to minimize the risk to everyone.