WP PageNavi Style plugin stored XSS via CSRF
A WordPress page-number plugin can plant harmful behavior on visitors' screens.
Summary
The WP PageNavi Style plugin through version 1.4 does not check for CSRF when settings are saved. An attacker can trick a logged-in administrator into storing malicious JavaScript, which then runs in the browser of everyone who visits the site's front end.
Affected when
- A logged-in administrator must visit an attacker's page
- WP PageNavi Style through 1.4 installed
What to do
No fixed version is known. Check that the plugin runs a version newer than 1.4 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen