Christopher Skyi

It’s possible that hackers, once they break into the site, could see this plug-in as a good opportunity to further their attack by modifying it. Why not take the information I’ve given you and contact websitedefender or some other security expert? It can only make your plug-in better

“Did you even look at the source code? The plugin is not using anything you are mentioning here but standard function of flickr API.”

Take it up with websitedefender.com, not me. They’re the ones who called the plug-in out as a high security risk for wordpress.

“1. try going to settings > pages > event pages and choosing to display events as a page, not post”

Right, this is exactly what you would do. This is a clear feature of this plug-in, but . . . it’s clearly broken, i.e., it doesn’t work. So the rest of this thread works through one failed hack after another. That’s reason enough for me to abandon this plug-ins. Sorry guys — it looked good on paper, and I work for a non-profit that could have really used this, but they don’t have the time and money is going to take to get this to work. By hand, I can easily create what they need using normal theme pages.

Forgot. The hack results in download attempts of “Exploit javascript obfuscation 1494” whenever one went to a page where this plug-in was used:

https://www.avgthreatlabs.com/webthreats/info/javascript-obfuscation/