Skip to content
OpenAdvisories

Vendor

pixelgrade

19 known vulnerabilities.

Products

Category Icon 4 Comments Ratings 3 PixTypes 2 Nova Blocks 2 PixFields 2 Open Hours – Easy Opening Hours 1 Customify – Intuitive Website Styling 1 Style Manager 1 Backstage – Customizer Demo Access 1 Nova Blocks by Pixelgrade 1 PixProof 1
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-24528

    WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.

    pixelgrade Nova Blocks
  • Medium 5.9
    CVE-2025-68525

    WordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through <= 1.0.2.

    pixelgrade Category Icon
  • Medium 4.3
    CVE-2025-39425

    WordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: from n/a through <= 2.2.7.

    pixelgrade Style Manager
  • Medium 4.9
    CVE-2025-31825

    WordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.This issue affects Category Icon: from n/a through <= 1.0.1.

    pixelgrade Category Icon
  • Medium 6.5
    CVE-2025-31819

    WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.

    pixelgrade Nova Blocks
  • Medium 6.4
    CVE-2024-12813

    Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping…

    pixelgrade Open Hours – Easy Opening Hours Web / CMS
  • Medium 5.3
    CVE-2024-54417

    WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.

    pixelgrade PixProof
  • Medium 6.4
    CVE-2024-8915

    Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers…

    pixelgrade Category Icon Web / CMS
  • Medium 6.4
    CVE-2024-8241

    Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

    The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escap…

    pixelgrade Nova Blocks by Pixelgrade Web / CMS
  • Medium 4.3
    CVE-2023-27633

    WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.

    pixelgrade Customify – Intuitive Website Styling
  • Medium 5.9
    CVE-2023-23702

    WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.

    pixelgrade Comments Ratings
  • Medium 4.3
    CVE-2023-45655

    WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.

    pixelgrade PixFields
  • Medium 4.3
    CVE-2023-45654

    WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.

    pixelgrade Comments Ratings
  • Medium 4.3
    CVE-2023-23704

    WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.

    pixelgrade Comments Ratings
  • Medium 4.3
    CVE-2023-25487

    WordPress PixTypes Plugin <= 1.4.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions.

    pixelgrade PixTypes
  • Medium 6.5
    CVE-2022-46844

    WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.

    pixelgrade PixFields