Nova Blocks Vulnerabilities

The Nova Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.1.9

Fixed in:

2.1.10

Disclosed:

Jan 26, 2026

CVE-2026-24528 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.

Affected:

up to 2.1.9

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24528 on NVD →

The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 2.1.8

Fixed in:

2.1.9

Disclosed:

Apr 1, 2025

CVE-2025-31819 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks by Pixelgrade. This issue affects Nova Blocks by Pixelgrade: from n/a through 2.1.8.

Affected:

up to 2.1.8

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31819 on NVD →

[en] The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Sep 10, 2024

CVE-2024-8241 on NVD →

The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

CVSS:

6.4

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Sep 9, 2024

CVE-2024-8241 on NVD →