CVE-2026-109150
Received Received - Intake

Cross-Site Scripting in WP PageNavi Style WordPress Plugin

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: WPScan

Description
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-109150
EUVD
EUVD-2026-117357

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WP PageNavi Style 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP PageNavi Style WordPress plugin through version 1.4 has a stored Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization and escaping of certain settings. It also lacks CSRF protection when saving these settings, allowing attackers to inject malicious JavaScript via a CSRF attack.

Detection Guidance

Check if the WP PageNavi Style plugin version 1.4 or below is installed on your WordPress site. Inspect the plugin's settings for unsanitized inputs or unexpected JavaScript code in saved configurations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the browsers of all users visiting the site's front end. This could lead to session hijacking, defacement, or theft of sensitive user data if a logged-in administrator is tricked into saving malicious settings.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, exposing sensitive information and potentially leading to legal penalties or compliance violations.

Mitigation Strategies

Immediately update the WP PageNavi Style plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Monitor for suspicious activity in plugin settings or frontend scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...