Breadcrumb NavXT

Breadcrumb NavXT has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 3 issues recorded for Breadcrumb NavXT has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Breadcrumb NavXT is installed on roughly 800,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Breadcrumb NavXT vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-84765

Breadcrumb NavXT <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2026-09-02 00:00	Breadcrumb NavXT <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting Breadcrumb NavXT <= 7.5.1	`CVE-2026-84765`	7.2 High	Jiemook	Yes
2026-02-18 00:00	Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure Breadcrumb NavXT <= 7.5.0	`CVE-2025-13842`	5.3 Medium	NosleeP++	Yes
2018-09-26 00:00	Breadcrumb NavXT <= 6.1.0 - Sensitive Data Exposure Breadcrumb NavXT <= 6.1.0	`N/A`	5.3 Medium	Janek Vind	Yes

Showing 1–3 of 3 reports

Latestv7.5.2

Breadcrumb NavXT

Author

John Havlik

4.6(132)

92/100

Last Updated

2026-08-29 (14d ago)

Active Installs

800,000+

Downloads

17,615,540

Requires WP

5.8+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2007-12-01 (19y ago)

Breadcrumb NavXT, the successor to the popular WordPress plugin Breadcrumb Navigation XT, was written from the ground up to be better than its ancestor. This plugin generates locational breadcrumb trails for your WordPress powered blog or website. These breadcrumb trails are highly customizable to suit the needs of just about any website running WordPress. The Administrative interface makes setting options easy, while a direct class access is available for theme developers and more adventurous users. PHP Requirements Breadcrumb NavXT 7.0 and newer require PHP7.0 Breadcrumb NavXT 5.2 and newer require PHP5.3 Breadcrumb NavXT 5.1.1 and older require PHP5.2 Features (non-exhaustive) RDFa format Schema.org BreadcrumbList compatible breadcrumb generation. Extensive breadcrumb customization control via a settings page with appropriate default values for most use cases. Network admin settings page for managing breadcrumb settings for all subsites with configurable global priority. Built in WordPress Widget. Extensible via OOP and provided actions and filters. WPML compatible (enhanced compatibility with WPML extensions plugin). Polylang compatible (enhanced compatibility with Polylang extensions plugin). bbPress compatible (enhanced compatibility with bbPress extensions plugin). BuddyPress compatible (enhanced compatibility with BuddyPress extensions plugin). Translations Breadcrumb NavXT now supports WordPress.org language packs. Want to translate Breadcrumb NavXT? Visit Breadcrumb NavXT’s WordPress.org translation project.

View on WordPress.org