The vulnerability is a Cross‑Site Request Forgery flaw that permits an attacker to inject malicious script and store it within the WordPress database. Once stored, the script executes in the browsers of any user who views the affected content, potentially leading to session hijacking, credential theft, or defacement. The weakness corresponds to CWE‑352, a classic CSRF attack that elevates to persistent XSS when payloads are written to the site’s storage.

WordPress sites that have installed the DevriX Hashtags plugin version 0.3.2 or earlier are affected. This includes all builds of the plugin from the initial release up to and including 0.3.2.

The CVSS score of 7.1 reflects a moderate risk level, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Attacks would target authenticated users who have legitimate permissions to use the plugin, so the threat vector is web‑based and relies on the attacker tricking a user into visiting a crafted URL or submitting a forged form. Because the vulnerability is only triggered when the user is logged in, broad public exposure is limited, but any compromised user session becomes vulnerable to the stored payload.