CVE-2026-109150 · Package
NO FIX YET
The WP PageNavi Style WordPress plugin through version 1.4 does not sanitise or escape some settings and lacks a CSRF check when they are saved. An attacker can trick a logged-in administrator into saving JavaScript that then runs in the browser of every visitor to the site's front end.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP PageNavi Style plugin at version 1.4 or earlier are exposed, since the flaw lives in its settings page. The attack needs a logged-in administrator to visit a malicious page, and the stored script then reaches visitors to the public front end. Sites without this plugin, or with it removed, can skip it.
Not affected if plugin-deactivated, plugin-not-installed
Who cares wordpress, wp-pagenavi-style
wp-content/plugins/ and read its version headerNo fix yet, per the sources.
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.