{"id":"CVE-2026-109150","kind":"vulnerability","aliases":["CVE-2026-109150"],"related":[],"title":"WP PageNavi Style WordPress plugin: CSRF lets attackers store scripts","description":"The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.","summary":"The WP PageNavi Style WordPress plugin through version 1.4 does not sanitise or escape some settings and lacks a CSRF check when they are saved. An attacker can trick a logged-in administrator into saving JavaScript that then runs in the browser of every visitor to the site's front end.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-pagenavi-style"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- Check whether the WP PageNavi Style plugin is installed and its version in the WordPress admin under Plugins\n- Look for the plugin folder `wp-content/plugins/` and read its version header\n- Confirm whether the plugin is active on the site","fix":null,"status":"open","published_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:12+00:00","updated_at":"2026-11-05T06:33:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP PageNavi Style WordPress plugin: CSRF lets attackers store scripts","impact":"medium","summary":"The WP PageNavi Style WordPress plugin through version 1.4 does not sanitise or escape some settings and lacks a CSRF check when they are saved. An attacker can trick a logged-in administrator into saving JavaScript that then runs in the browser of every visitor to the site's front end.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-pagenavi-style"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker stores scripts that run in every visitor's browser","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry gives no fixed version.","how_to_check":"- Check whether the WP PageNavi Style plugin is installed and its version in the WordPress admin under Plugins\n- Look for the plugin folder `wp-content/plugins/` and read its version header\n- Confirm whether the plugin is active on the site","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"who_is_affected":"Sites running the WP PageNavi Style plugin at version 1.4 or earlier are exposed, since the flaw lives in its settings page. The attack needs a logged-in administrator to visit a malicious page, and the stored script then reaches visitors to the public front end. Sites without this plugin, or with it removed, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4232,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109150':13A,16A '-2026':12A,15A '1.4':31B,82C 'administr':56B,111C 'allow':103C 'arbitrari':113C 'attack':8A,49B,104C,118C 'browser':65B,125C 'check':43B,96C 'could':102C 'csrf':6A,42B,95C,117C 'cve':11A,14A 'end':74B,134C 'escap':36B,87C 'everi':67B 'everyon':127C 'execut':122C 'front':73B,133C 'javascript':59B,114C 'lack':40B 'let':7A 'log':54B,109C 'logged-in':53B,108C 'make':106C 'packag':17B 'pagenavi':2A,21B,25B,77C 'plugin':5A,28B,80C 'run':62B 'sanitis':34B,85C 'save':47B,58B,100C 'script':10A 'set':38B,91C 'site':71B,131C 'store':9A,112C 'style':3A,22B,26B,78C 'trick':51B 'version':30B 'via':115C 'visit':129C 'visitor':68B 'wordpress':4A,18B,27B,79C 'wp':1A,20B,24B,76C 'wp-pagenavi-styl':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP PageNavi Style plugin at version 1.4 or earlier are exposed, since the flaw lives in its settings page. The attack needs a logged-in administrator to visit a malicious page, and the stored script then reaches visitors to the public front end. Sites without this plugin, or with it removed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wppagenavistyle"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109150","severity":null,"published_at":"2026-11-05T06:17:07+00:00","modified_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}