---
id: "CVE-2026-109150"
kind: "vulnerability"
aliases: ["CVE-2026-109150"]
title: "WP PageNavi Style WordPress plugin: CSRF lets attackers store scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-pagenavi-style"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-11-05T06:17:07+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109150", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# WP PageNavi Style WordPress plugin: CSRF lets attackers store scripts

The WP PageNavi Style WordPress plugin through version 1.4 does not sanitise or escape some settings and lacks a CSRF check when they are saved. An attacker can trick a logged-in administrator into saving JavaScript that then runs in the browser of every visitor to the site's front end.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WP PageNavi Style plugin is installed and its version in the WordPress admin under Plugins
- Look for the plugin folder `wp-content/plugins/` and read its version header
- Confirm whether the plugin is active on the site

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109150

## From the sources

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_