Devrix vulnerabilities
8 vulnerabilities
Known vulnerabilities in Devrix products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
Products
6- Easy Image Gallery2 vulnerabilities
- Restrict User Registration2 vulnerabilities
- DX Dark Site1 vulnerabilities
- DX Sales CRM1 vulnerabilities
- Dx Share Selection1 vulnerabilities
- Hashtags1 vulnerabilities
CVE-2025-2540devrixeasy image gallery+9
EPSS score0.33%
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-9892devrixrestrict user registration+1EPSS score0.15%
The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-28931devrixhashtags+1EPSS score0.15%
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2.CVE-2025-32655devrixrestrict user registration+1EPSS score0.15%
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through <= 1.0.1.CVE-2025-23575devrixdx sales crm+1EPSS score0.37%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevriX DX Sales CRM dx-sales-crm allows Reflected XSS.This issue affects DX Sales CRM: from n/a through <= 1.1.CVE-2022-2001devrixdx_share_selection+2EPSS score0.65%
The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.CVE-2024-54337devrixdx dark site+1EPSS score0.20%
Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through <= 1.0.1.CVE-2026-4766devrixeasy image gallery+1EPSS score0.32%
The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.