CVE-2026-109150
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
| Vendor | unknown |
| Product | wp pagenavi style |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp pagenavi style
Be the first to know when new unknown vulnerabilities affecting unknown wp pagenavi style are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP PageNavi Style
0 ≤ 1.4
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan