---
id: "CVE-2026-119158"
page: "https://infrastack.ai/live/CVE-2026-119158"
kind: "vulnerability"
aliases: ["CVE-2026-119158"]
title: "WordPress Pie Register plugin: unauthenticated stored XSS via first_name field"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pie-register", "fixed": ["3.8.4.17"], "affected": "<= 3.8.4.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "pie-register", "self-hosted", "wordpress"]
not_affected_if: ["no-profile-picture-field", "plugin-not-installed", "registration-closed"]
published_at: "2026-11-07T04:17:13+00:00"
first_seen_at: "2026-11-07T04:45:47+00:00"
updated_at: "2026-11-07T04:49:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119158", "first_seen_at": "2026-11-07T04:45:47+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar", "first_seen_at": "2026-11-07T04:49:18+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar", "https://patchstack.com/database/wordpress/plugin/pie-register/vulnerability/wordpress-pie-register-user-registration-profiles-content-restriction-plugin-3-8-4-16-unauthenticated-stored-cross-site-scripting-vulnerability"]}]
exploit_sources: []
---

# WordPress Pie Register plugin: unauthenticated stored XSS via first_name field

Link for people: https://infrastack.ai/live/CVE-2026-119158 (this .md is for agents)

The Pie Register WordPress plugin does not sanitize the first_name field in its registration form, so an anonymous visitor can store a script that runs in the browser of anyone who views the affected page. Attackers can use it to run scripts in other users' sessions on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:pie-register affected <= 3.8.4.16 fixed 3.8.4.17

## How to check

- In WordPress admin > Plugins, check the Pie Register version; 3.8.4.16 and earlier are vulnerable, 3.8.4.17 is patched. Or run: wp plugin get pie-register --field=version
- Exposed only if public registration is enabled and the registration form includes a Profile Picture field. Also review recent Subscriber accounts with odd first names and their comments for script content.

## Fix

Update Pie Register to 3.8.4.17 or later

## Timeline

- 2026-11-07T04:45:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119158
- 2026-11-07T04:49:18+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar — Wordfence advisory (CNA) and Patchstack both give patched version 3.8.4.17; vendor changelog not read, so fix is from Wordfence. Attack: register with payload in first_name, log in as Subscriber, post comment that delivers it to visitors. No exploitation or PoC found. Related sibling CVE-2026-119488 (stored XSS <=3.8.4.15) seen, not merged.

## Documents

- [advisory] Wordfence: Pie Register <= 3.8.4.16 Unauthenticated Stored XSS via first_name https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pie-register/pie-register-38416-unauthenticated-stored-cross-site-scripting-via-first-name-parameter-via-comment-avatar
- [describes] Patchstack: Pie Register <= 3.8.4.16 XSS, patched 3.8.4.17 https://patchstack.com/database/wordpress/plugin/pie-register/vulnerability/wordpress-pie-register-user-registration-profiles-content-restriction-plugin-3-8-4-16-unauthenticated-stored-cross-site-scripting-vulnerability

## From the sources

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is emitted to unauthenticated visitors) to store the payload, then logs in as the newly created Subscriber to post a comment that triggers delivery to all page visitors.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_