WordPress Plugin Vulnerabilities

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

Description

The plugin does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.

Proof of Concept

Affects Plugins

Plugin icon
wp-pagenavi-style
No known fix

References

CVE
CVE-2026-109150

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
10a889d8-9e15-42b9-a001-622e97ab5d06

Timeline

Publicly Published
2026-11-03 (about 2 days ago)
Added
2026-11-03 (about 1 day ago)
Last Updated
2026-11-04 (about 7 hours ago)

Other

Published
Title
Published
2022-12-23
Title
ProfilePress < 4.5.1 - Admin+ Stored Cross-Site Scripting via Form Settings
Published
2026-01-16
Title
Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
Published
2024-05-06
Title
Forty Four – 404 Plugin for WordPress <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-02-02
Title
Dreamstime Stock Photos < 4.2 - Reflected Cross-Site Scripting