Image Hotspot by DevVN

Image Hotspot by DevVN has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Code Injection, behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Image Hotspot by DevVN has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Image Hotspot by DevVN is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Image Hotspot by DevVN vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-7656

Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection

Read the full analysis

Vulnerability Records

2 records


2026-02-18 00:00	Image Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta Image Hotspot by DevVN <= 1.2.9	`CVE-2025-14445`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-08-23 00:00	Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection Image Hotspot by DevVN <= 1.2.5	`CVE-2024-7656`	8.8 High	Lucio Sá	Yes

Showing 1–2 of 2 reports

Latestv1.3.0

Image Hotspot by DevVN

Author

Le Van Toan

4.3(29)

86/100

Last Updated

2025-12-11 (9mo ago)

Active Installs

20,000+

Downloads

397,020

Requires WP

4.6+

Requires PHP

Tested up to

WP 6.9.7

Created

2016-09-26 (10y ago)

Image Hotspot by DevVN helps you add hotspots to your images. Usage Copy your shortcode to view, e.g.: [devvn_ihotspot id=”YOUR_ID”] jQuery plugin include jQuery PowerTip PowerTop Home

View on WordPress.org