The DevriX Hashtags WordPress plugin (version 0.3.2 and earlier) contains a CSRF vulnerability that enables an attacker to inject stored XSS payloads. This vulnerability arises from insufficient protection against unauthorized requests that can lead to persistent script injection, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can result in partial compromise of confidentiality, integrity, and availability of the affected application or user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling or removing the affected plugin version or applying any recommended temporary mitigations from the vendor once available.