Pixelite's vulnerability footprint concentrates in WordPress plugins, particularly its events management, responsive favicons, and calendar functionality extensions, which address a widely deployed but narrowly scoped attack surface. The vendor's disclosures cluster consistently around input-handling and output-encoding defects—cross-site scripting, SQL injection, code injection, and cross-site request forgery—reflecting the common weaknesses endemic to WordPress plugin development where user-supplied content flows through web-page rendering and database queries. These weakness classes are characteristic of web-application plugins and carry structural risk proportional to their exposure on public-facing WordPress installations. Defenders should prioritize inventory and patching of affected plugins and apply strict input validation and output-encoding discipline to custom or upstream plugin code; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pixelite over time
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-6970HIGH The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and in | Jul 9, 2025 | 7.5 | 67 | NO | YES |
CVE-2015-9298CRITICAL The events-manager plugin before 5.6 for WordPress has code injection. | Aug 13, 2019 | 9.8 | 26 | NO | NO |
CVE-2024-30515HIGH Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4. | Jun 9, 2024 | 8.8 | 24 | NO | NO |
CVE-2020-35012HIGH The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection | Dec 1, 2021 | 7.2 | 24 | NO | NO |
CVE-2024-11260HIGH The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, an | Feb 21, 2025 | 7.5 | 22 | NO | NO |
CVE-2020-35037MEDIUM The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues | Dec 1, 2021 | 6.1 | 22 | NO | NO |
CVE-2013-7477MEDIUM The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. | Aug 22, 2019 | 6.1 | 22 | NO | NO |
CVE-2013-7480MEDIUM The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | Aug 22, 2019 | 6.1 | 21 | NO | NO |
CVE-2013-7479MEDIUM The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | Aug 22, 2019 | 6.1 | 21 | NO | NO |
CVE-2013-7478MEDIUM The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | Aug 22, 2019 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pixelite.
Media articles that mention a CVE ID that affects a product developed by Pixelite — matched by CVE ID, not by vendor name.