{"id":"CVE-2026-119158","kind":"vulnerability","aliases":["CVE-2026-119158"],"related":[],"title":"WordPress Pie Register plugin: unauthenticated stored XSS via first_name field","description":"The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is emitted to unauthenticated visitors) to store the payload, then logs in as the newly created Subscriber to post a comment that triggers delivery to all page visitors.","summary":"The Pie Register WordPress plugin does not sanitize the first_name field in its registration form, so an anonymous visitor can store a script that runs in the browser of anyone who views the affected page. Attackers can use it to run scripts in other users' sessions on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pie-register","fixed":["3.8.4.17"],"affected":"<= 3.8.4.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","pie-register","self-hosted","wordpress"],"not_affected_if":["no-profile-picture-field","plugin-not-installed","registration-closed"],"how_to_check":"- In WordPress admin > Plugins, check the Pie Register version; 3.8.4.16 and earlier are vulnerable, 3.8.4.17 is patched. Or run: wp plugin get pie-register --field=version\n- Exposed only if public registration is enabled and the registration form includes a Profile Picture field. Also review recent Subscriber accounts with odd first names and their comments for script content.","fix":"Update Pie Register to 3.8.4.17 or later","status":"open","published_at":"2026-11-07T04:17:13+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:53+00:00","updated_at":"2026-11-07T04:49:18+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T04:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Pie Register plugin: unauthenticated stored XSS via first_name field","impact":"medium","summary":"The Pie Register WordPress plugin does not sanitize the first_name field in its registration form, so an anonymous visitor can store a script that runs in the browser of anyone who views the affected page. Attackers can use it to run scripts in other users' sessions on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pie-register","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers and steals sessions","analyst_note":"Confirm the patched plugin version from the NVD or plugin changelog; the sources give no fixed version.","how_to_check":"- Check the installed Pie Register plugin version in the WordPress admin plugin list; the sources say versions up to and including `3.8.4.16` are affected\n- Check whether public registration is enabled and whether the registration form includes a Profile Picture field\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["registration-closed","no-profile-picture-field","plugin-not-installed"],"who_is_affected":"Sites running the Pie Register plugin up to and including 3.8.4.16 with public registration enabled and a Profile Picture field on the registration form. The sources say the attacker can register without an account, so a site with public registration open is the exposed case. Sites without the plugin or with registration closed are not affected by this description.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":4378,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched plugin version from the NVD or plugin changelog; the sources give no fixed version.","search":"'-119158':14A,17A '-2026':13A,16A '3.8.4.16':110C 'access':139C,166C 'affect':63B 'anonym':47B 'anyon':59B 'arbitrari':128C 'attack':65B,125C,161C 'browser':57B 'comment':189C 'content':85C 'creat':184C 'cross':95C 'cross-sit':94C 'cve':12A,15A 'deliveri':192C 'due':111C 'emit':170C 'enabl':150C 'escap':118C 'execut':135C 'exploit':145C 'field':11A,40B,159C 'first':9A,38B,100C 'form':44B,154C,167C 'host':27B 'includ':109C,155C 'inject':127C,141C 'input':114C 'insuffici':113C 'log':179C 'make':120C 'name':10A,39B,101C 'newli':183C 'nonc':168C 'output':117C 'packag':21B 'page':64B,132C,142C,195C 'paramet':102C 'payload':177C 'pictur':158C 'pie':2A,19A,23B,30B,80C 'pie-regist':22B 'pie-register':18A 'plugin':4A,33B,87C 'possibl':122C 'post':187C 'profil':84C,157C 'public':147C,165C 'regist':3A,24B,31B,81C,162C 'register':20A 'registr':43B,83C,148C,153C 'restrict':86C 'run':54B,70B 'sanit':36B,115C 'script':52B,71B,97C,130C 'self':26B 'self-host':25B 'session':75B 'site':78B,96C 'store':6A,50B,93C,175C 'subscrib':185C 'trigger':191C 'unauthent':5A,124C,172C 'use':67B 'user':74B,82C,138C 'version':105C 'via':8A,98C,163C 'view':61B 'visitor':48B,173C,196C 'vulner':91C 'web':129C 'whenev':136C 'wordpress':1A,28B,32B,89C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Pie Register plugin up to and including 3.8.4.16 with public registration enabled and a Profile Picture field on the registration form. The sources say the attacker can register without an account, so a site with public registration open is the exposed case. Sites without the plugin or with registration closed are not affected by this description.","tier":"B","verified":{"fix":{"at":"2026-11-07T04:49:18Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar","run_id":1953},"who_affected":{"at":"2026-11-07T04:49:18Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar","run_id":1953}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pieregister"],"ptokens":["pie","register"],"labels":["high","package","pieregister","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119158':14A,17A '-2026':13A,16A 'cve':12A,15A 'field':11A 'first':9A 'name':10A 'pie':2A,19A 'pie-register':18A 'plugin':4A 'regist':3A 'register':20A 'store':6A 'unauthent':5A 'via':8A 'wordpress':1A 'xss':7A","search_b":"'affect':63B 'anonym':47B 'anyon':59B 'attack':65B 'browser':57B 'field':40B 'first':38B 'form':44B 'host':27B 'name':39B 'packag':21B 'page':64B 'pie':23B,30B 'pie-regist':22B 'plugin':33B 'regist':24B,31B 'registr':43B 'run':54B,70B 'sanit':36B 'script':52B,71B 'self':26B 'self-host':25B 'session':75B 'site':78B 'store':50B 'use':67B 'user':74B 'view':61B 'visitor':48B 'wordpress':28B,32B","search_c":"'3.8.4.16':110C 'access':139C,166C 'arbitrari':128C 'attack':125C,161C 'comment':189C 'content':85C 'creat':184C 'cross':95C 'cross-sit':94C 'deliveri':192C 'due':111C 'emit':170C 'enabl':150C 'escap':118C 'execut':135C 'exploit':145C 'field':159C 'first':100C 'form':154C,167C 'includ':109C,155C 'inject':127C,141C 'input':114C 'insuffici':113C 'log':179C 'make':120C 'name':101C 'newli':183C 'nonc':168C 'output':117C 'page':132C,142C,195C 'paramet':102C 'payload':177C 'pictur':158C 'pie':80C 'plugin':87C 'possibl':122C 'post':187C 'profil':84C,157C 'public':147C,165C 'regist':81C,162C 'registr':83C,148C,153C 'restrict':86C 'sanit':115C 'script':97C,130C 'site':96C 'store':93C,175C 'subscrib':185C 'trigger':191C 'unauthent':124C,172C 'user':82C,138C 'version':105C 'via':98C,163C 'visitor':173C,196C 'vulner':91C 'web':129C 'whenev':136C 'wordpress':89C","first_public_at":"2026-11-07T04:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119158","severity":null,"published_at":"2026-11-07T04:17:13+00:00","modified_at":"2026-11-07T04:17:13+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119158:1953","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar","severity":null,"published_at":"2026-11-07T04:49:18+00:00","modified_at":"2026-11-07T04:49:18+00:00","first_seen_at":"2026-11-07T04:49:18+00:00","fetched_at":"2026-11-07T04:49:18+00:00","note":"Wordfence advisory (CNA) and Patchstack both give patched version 3.8.4.17; vendor changelog not read, so fix is from Wordfence. Attack: register with payload in first_name, log in as Subscriber, post comment that delivers it to visitors. No exploitation or PoC found. Related sibling CVE-2026-119488 (stored XSS <=3.8.4.15) seen, not merged.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar","https://patchstack.com/database/wordpress/plugin/pie-register/vulnerability/wordpress-pie-register-user-registration-profiles-content-restriction-plugin-3-8-4-16-unauthenticated-stored-cross-site-scripting-vulnerability"]}],"documents":[{"id":92833,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar","title":"Wordfence: Pie Register <= 3.8.4.16 Unauthenticated Stored XSS via first_name","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":92835,"url":"https://patchstack.com/database/wordpress/plugin/pie-register/vulnerability/wordpress-pie-register-user-registration-profiles-content-restriction-plugin-3-8-4-16-unauthenticated-stored-cross-site-scripting-vulnerability","title":"Patchstack: Pie Register <= 3.8.4.16 XSS, patched 3.8.4.17","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}