Vulnerabilities

TI-2026-08616 CVE-2026-9842 · GHSA-xwxr-p855-gjc3

Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities

LOW 39

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-07-08 No fix listed CWE-269

TI-2026-19769 CVE-2026-24528 · GHSA-m8pw-x258-449r

WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0019 Published 2026-01-23 No fix listed CWE-79

TI-2025-42046 CVE-2025-68525 · GHSA-vh4j-wc5r-44xh

WordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through <= 1.0.2.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00181 Published 2025-12-24 No fix listed CWE-79

TI-2025-22309 CVE-2025-31039 · GHSA-hg4j-xgv6-pcr2

WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

MEDIUM 42

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through <= 1.0.3.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00552 Published 2025-06-09 No fix listed CWE-611

TI-2025-26167 CVE-2025-39425 · GHSA-r5xc-x759-88vq

WordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: from n/a through <= 2.2.7.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00168 Published 2025-04-17 No fix listed CWE-352

TI-2025-22962 CVE-2025-31825 · GHSA-f53v-h6c6-f654

WordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability

LOW 23

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.This issue affects Category Icon: from n/a through <= 1.0.1.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00569 Published 2025-04-03 No fix listed CWE-22

TI-2025-22956 CVE-2025-31819 · GHSA-66j2-p2w8-5252

WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00298 Published 2025-04-01 No fix listed CWE-79

TI-2024-11874 CVE-2024-12813 · GHSA-5rg9-ph4r-3frg

Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00293 Published 2025-02-18 No fix listed CWE-79

TI-2024-36503 CVE-2024-54417 · GHSA-c68r-r29p-9xpp

WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability

LOW 31

Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00538 Published 2024-12-16 No fix listed CWE-862

TI-2024-08278 CVE-2024-8915 · GHSA-7pc6-64hm-2g2w

Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

LOW 28

The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2024-10-12 No fix listed CWE-79

TI-2024-07639 CVE-2024-8241 · GHSA-88gp-qchm-x67w

Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

LOW 29

The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insuffici…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00373 Published 2024-09-10 No fix listed CWE-79

TI-2023-12343 CVE-2023-27633 · GHSA-f4cg-wwwj-wcm8

WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00295 Published 2023-11-22 No fix listed CWE-352

TI-2023-09516 CVE-2023-23702 · GHSA-7m7m-p296-cg75

WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-11-06 No fix listed CWE-79

TI-2023-24456 CVE-2023-45655 · GHSA-cc7h-9j52-gh84

WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2023-10-16 No fix listed CWE-352

TI-2023-24455 CVE-2023-45654 · GHSA-8j9h-fmv7-4h7w

WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2023-10-16 No fix listed CWE-352

TI-2023-21075 CVE-2023-40205 · GHSA-q8g7-rfrq-xqhj

WordPress PixTypes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pixelgrade PixTypes plugin <= 1.4.15 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-09-04 No fix listed CWE-79

TI-2023-09518 CVE-2023-23704 · GHSA-2p68-5cjx-px9g

WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-07-11 No fix listed CWE-352

TI-2023-10797 CVE-2023-25487 · GHSA-8h69-jgr4-jvv3

WordPress PixTypes Plugin <= 1.4.14 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-07-11 No fix listed CWE-352

TI-2022-23189 CVE-2022-46844 · GHSA-xhcf-h698-rm2h

WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00361 Published 2023-05-09 No fix listed CWE-79

TI-2022-04269 CVE-2022-4671 · GHSA-438j-8gh2-h5w4

PixCodes < 2.3.7 - Contributor+ Stored XSS in Shortcode

MEDIUM 58

The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Store…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-01-30 Fixed in 2.3.7

Vulnerabilities

Filters