Image Editor by Pixo
Image Editor by Pixo has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Image Editor by Pixo is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-58232Image Editor by Pixo <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Image Editor by Pixo
Author
Ickata
Pixo is cross-platform image editor. It can be integrated into any web app. This plugin does exactly this – it fully replaces WordPress’ default image editor with this more powerful one, and integrates it into the front-end. Features: Remove Background Resize Image & Upscale with high quality Instagram-like Filters Stock and custom Stickers (from file or URL) Rich Text editing Drawing Beautiful Photo Frames Shapes Image filesize optimization Batch editing (supported only in Media list view) Updates all posts where the image has been referenced Can attach to every file input field in the front-end! Crop, Flip, Rotate Color corrections (RGB, HSV, brightness/contrast, and more) Restore previous sessions and make changes to images (undo changes, update text, and more) Image optimization via TinyPNG Ability to choose to which image size to apply changes to (all, thumbnail, all except thumbnail) Supports Block Editor (Gutenberg) Supports Multisite Mobile-friendly Pixo is external service that requires registration. This plugin only wraps the service into WordPress and does the registration automatically for you. The registration is with your WordPress user’s email address and a randomly generated password. To change that password visit the Control Panel. Pixo’s Privacy Policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C