Stored Cross-Site Scripting Vulnerability in Pie Register by WordPress

CVE-2026-119158

What is CVE-2026-119158?

The Pie Register plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on the 'first_name' parameter. This issue affects all versions up to 3.8.4.16 and allows attackers to inject malicious scripts into pages that are executed when users access those pages. If public registration is enabled, an attacker can exploit this vulnerability by registering through the accessible form and embedding a payload in the Profile Picture field. After logging in with the new account, the attacker can post a comment, triggering the script execution for all visitors to the affected page.

References