[Plugin: Stout Google Calendar] Google and our hosting company says this plugin is Malware.

I have been notified by a few others as well. I find it interesting that Google is complaining about the “plugin” asking for login information when, in fact, it is Google who is asking for the information. And the only reason Google is asking for the login is because the site owner did not share the calendar to the public, which is required for this plugin to work properly. I’ve inquired in the Google forums and will keep everyone posted here

Got this too. Funny thing is, I don’t even use this plugin.

They also quoted a weird location: wp-includes.bak (a backup I made over a year ago)

Yeah, I got the message too. I had my calendar public, but got the warning anyway. I agree this is a bit wierd because it is Google asking for the login info, only if they want to add the calendar to their calendar. Anyway, I hope this get worked out.

@bazil749 – I have a post in the Google forums and people are reporting that their hosting companies are mistakenly telling them they have this plugin installed. The plugin didn’t exist a year ago so there’s no way it could possibly be in that backup. The best I can tell you is contact your host and verify that you received this message from them in error.

@carpetguy – Is there any chance that your calendar wasn’t shared at any point during the setup and/or use of the plugin? The Stout Google plugin “intercepts” the incoming calendar from Google and rewrites the CSS to style it as you would like. If the calendar is not shared as it should be then the login is displayed via the Stout Google Calendar script. This is where Google is seeing it as phishing. I don’t know exactly how they are determining which sites are using the plugin but my guess is that at some point during the setup the calendar wasn’t shared properly and the script pinged their server to login. They catch this “phishing” attempt and then report it to the hosting company that the site resides on. Maybe they caught on some other way and are just sending blanket messages out to hosting companies – although this doesn’t seem to be the case.

Unfortunately, I don’t have a good answer for you and I don’t think using the plugin is worth anyone’s site being shut down. I’m trying to think of ways to rework this plugin but don’t have a solution at the time.

I have an image of my settings here,the calendar is shared, but, I also selected the “Share only my free/busy information (Hide details)” could that do it? I just don’t see how it could be a problem, but, that’s Google, I think maybe they have gotten a little to big and powerful, it’s almost scary how they control us.

Have you considered reworking the plugin so that users are aware to only use this on 100% public calendars? Is there a way to detect a calendar is 100% public before displaying? Perhaps you could rename the whole plugin and try again with a code that doesn’t pingback or refuses to display a non-public calendar. I have had a few of my custom iframes cause in Google’s hypersensitive filters. In the past my only options were to totally buy a new domain. With a bazillion users, Google never really seems to me to be concerned about a few tens of thousand people inconvenienced by their policies.

@mayb101 – Yes, I’ve been considering a check to determine whether or not the calendar is 100% public. I haven’t really thought it through but the main problem I see is that a calendar owner must log out of their Google account to really see if the calendar is in fact shared. I know this seems as simple as explaining it in the FAQs, Installation and on the plugin admin page, but I have found that people still don’t read this info and ask questions that have already been addressed. I have some ideas how I may be able to help encourage this behavior but now have to find the time to give it a shot.