CVE-2026-109150: high-severity vulnerability in WP PageNavi Style
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.1epss 0.1%
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected products
Unknown · WP PageNavi Stylepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/10a889d8-9e15-42b9-a001-622e97ab5d06/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.