DevItems vulnerabilities

Products

• HT Mega 4
• Support Genix 3
• HashBar – WordPress Notification Bar 2
• HT Event 1
• HT Politic 1
• ShopLentor 1
• WP Education 1

Latest DevItems CVEs

Newest publication first

1. CVE-2026-110895 WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

   Published 2026-10-18

   High·CVSS 8.5 EPSS 0.25%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

2. CVE-2026-94117 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability

   Published 2026-09-22

   High·CVSS 7.6 EPSS 0.38%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.

3. CVE-2026-66602 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-08-18

   High·CVSS 8.8 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

4. CVE-2025-58990 WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-09

   Medium·CVSS 5.4 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

5. CVE-2025-58635 WordPress Support Genix Plugin <= 1.4.23 - Broken Access Control Vulnerability

   Published 2025-09-03

   Medium·CVSS 5.3 EPSS 0.22%

   Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.23.

6. CVE-2025-54695 WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability

   Published 2025-08-14

   Medium·CVSS 5.4 EPSS 0.29%

   Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through <= 2.9.0.

7. CVE-2025-24624 WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1 EPSS 0.30%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Event ht-event allows Reflected XSS.This issue affects HT Event: from n/a through <= 1.4.6.

8. CVE-2025-30777 WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability

   Published 2025-03-27

   Medium·CVSS 4.3 EPSS 0.50%

   Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.11.

9. CVE-2024-51673 WordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability

   Published 2024-11-09

   Medium·CVSS 5.4 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Politic wp-politic allows DOM-Based XSS.This issue affects HT Politic: from n/a through <= 2.4.4.

10. CVE-2024-49630 WordPress WP Education for Elementor plugin <= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerability

    Published 2024-10-20

    Medium·CVSS 5.4 EPSS 0.28%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems WP Education wp-education allows Stored XSS.This issue affects WP Education: from n/a through <= 1.2.8.

11. CVE-2024-38706 WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability

    Published 2024-07-12

    High·CVSS 8.8 EPSS 0.70%

    Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7.

12. CVE-2024-32782 WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerability

    Published 2024-04-24

    Medium·CVSS 6.5 EPSS 0.87%

    Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7.

13. CVE-2024-30182 WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Published 2024-03-27

    Medium·CVSS 5.4 EPSS 0.36%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.