Pixelgrade
20 CVEs across 16 Pixelgrade products. Browse Pixelgrade vulnerabilities, severities, and proof-of-concept exploits.
Pixelgrade products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9842 | High | 7.5 | 2026-07-08 | The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to t… |
CVE-2026-24528 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.T… |
CVE-2025-68525 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS… |
CVE-2025-31039 | Critical | 9.1 | 2025-06-09 | Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Cate… |
CVE-2025-39425 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: f… |
CVE-2025-31825 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.Th… |
CVE-2025-31819 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nov… |
CVE-2024-12813 | Medium | 6.4 | 2025-02-18 | The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode i… |
CVE-2024-54417 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof… |
CVE-2024-8915 | Medium | 6.4 | 2024-10-12 | The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to ins… |
CVE-2024-8241 | Medium | 6.4 | 2024-09-10 | The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block… |
CVE-2023-27633 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions. |
CVE-2023-23702 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-45655 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions. |
CVE-2023-45654 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-40205 | High | 7.1 | 2023-09-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pixelgrade PixTypes plugin <= 1.4.15 versions. |
CVE-2023-25487 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions. |
CVE-2023-23704 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions. |
CVE-2022-46844 | Medium | 6.5 | 2023-05-09 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions. |
CVE-2022-4671 | Medium | 5.4 | 2023-01-30 | The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could a… |