Endless Posts Navigation

Endless Posts Navigation has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Endless Posts Navigation has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Endless Posts Navigation is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Endless Posts Navigation vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-25332

Endless Posts Navigation <= 2.2.9 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
Endless Posts Navigation banner
Latestv2.4.0

Endless Posts Navigation

Fahad Mahmood

Author

Fahad Mahmood

5.0(3)
100/100
Last Updated
2026-10-26 (2d ago)
Active Installs
100+
Downloads
11,398
Requires WP
4.7+
Requires PHP
7.0+
Tested up to
WP 7.0.7
Created
2013-12-10 (13y ago)

It automatically detects the post type where it is implemented and provide the endless navigation from the same taxonomy/category. You don’t need to worry about its order. It automatically manages alphabetical order for next and previous navigation. When the visitor reaches the last item, “next” takes him back to the first one (and the other way round), that is why it is endless. Author: Fahad Mahmood Project URI: http://androidbubble.com/blog/wordpress/plugins/endless-posts-navigation License: GPLv2 or later. The bundled PHP QR Code library is licensed under LGPL 3. Ways to add the navigation Template functions: epn_prev_post_link(true) and epn_next_post_link(true) in single.php, page.php or any custom post type template. Shortcodes (for block themes, page builders and widgets): [epn_nav] for both links, or [epn_prev] and [epn_next] separately. Optional attributes: text="Older" and within_cat="no". A the_content filter, see the plugin settings page for a ready to use snippet. Settings Previous / next texts, post titles instead of “previous” and “next”, and the sort order (post title or menu order). Developers epn_navigation_taxonomies filter: taxonomies used for the “same category” condition. Posts use categories, any other post type uses its public hierarchical taxonomies. Return an empty array to navigate within the whole post type. epn_navigation_query_args filter: arguments of the query which collects the posts to loop through. epn_link_html filter: final HTML of a previous/next link. Mobile app The settings can also be managed with the Endless Posts Navigation Android app. Open the QR code on the settings page and scan it with the app. The QR code works once and expires in two minutes, paired sessions can be disconnected from the settings page at any time. Detailed description. Important! Visit my blog and suggest good features which you want to see in this plugin. Tags pagination, filtering, alphabet sequence, sorting next previous posts, sorting pages Video Tutorials: Endless Post Navigation – Normal: Endless Post Navigation – Leakage: License This WordPress Plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or any later version. This free software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this software. If not, see http://www.gnu.org/licenses/gpl-2.0.html.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C