CVE-2026-109150 WP PageNavi Style CVE debrief

Who should care

Administrators of WordPress installations with the WP PageNavi Style plugin should assess exposure and verify if their plugin version is 1.4 or earlier. They should also review and sanitize administrator-stored settings, and update to a patched version if available. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Why it matters

The WP PageNavi Style WordPress plugin vulnerability allows attackers to store arbitrary JavaScript, which can be executed in the browsers of site visitors. Administrators of WordPress installations with this plugin should verify their plugin version and update to a patched version if available.

• Attackers could make a logged-in administrator store arbitrary JavaScript via a CSRF attack.
• The stored JavaScript would be executed in the browser of everyone who visits the site's front end.

Technical summary

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved. This allows attackers to store arbitrary JavaScript, which can be executed in the browsers of site visitors. The vulnerability is caused by a lack of sanitization and CSRF checks in the plugin's settings, which can be exploited by attackers to store malicious JavaScript code. This code can then be executed in the browsers of site visitors, potentially leading to malicious actions being performed on behalf of the site's users.

Defensive priority

Administrators of WordPress installations with the WP PageNavi Style plugin should verify if their plugin version is 1.4 or earlier and update to a patched version if available.

Recommended defensive actions

• Verify if the WP PageNavi Style plugin version is 1.4 or earlier
• Update to a patched version if available
• Review and sanitize administrator-stored settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in the WP PageNavi Style WordPress plugin. The vulnerability is caused by a lack of sanitization and CSRF checks in the plugin's settings. The CVE record was published on 2026-11-05T06:17:07.577Z and has not been modified since then. The NVD entry provides additional information about the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.