{"id":"CVE-2026-119488","kind":"vulnerability","aliases":["CVE-2026-119488"],"related":[],"title":"Pie Register WordPress plugin: stored XSS through version 3.8.4.15","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.","summary":"Pie Register, a WordPress user registration plugin by Shamim Rajani, has a stored cross-site scripting flaw in versions up to 3.8.4.15. An attacker can save script code that runs in the browser of other users who view the affected page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pie-register","fixed":["3.8.4.16"],"affected":"<= 3.8.4.15","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","pie-register","stored-xss","wordpress","xss"],"not_affected_if":["patched-3.8.4.16","plugin-not-installed"],"how_to_check":"- In WordPress admin go to Plugins and read the Pie Register version, or read the Version header in wp-content/plugins/pie-register/pie-register.php.\n- With WP-CLI: wp plugin get pie-register --field=version. Versions <= 3.8.4.15 are affected; update to 3.8.4.16 or later (3.8.4.17 is newer).","fix":"Update Pie Register to 3.8.4.16 or later (reported via Patchstack relay, not confirmed on vendor changelog). 3.8.4.17 is current per WPSec and also fixes a separate avatar XSS, so move to the latest version.","status":"open","published_at":"2026-11-06T08:17:18+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:34+00:00","updated_at":"2026-11-06T08:44:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Pie Register WordPress plugin: stored XSS through version 3.8.4.15","impact":"medium","summary":"Pie Register, a WordPress user registration plugin by Shamim Rajani, has a stored cross-site scripting flaw in versions up to 3.8.4.15. An attacker can save script code that runs in the browser of other users who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pie-register"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in other users' browsers, sessions may be stolen","analyst_note":"Check the NVD entry and the WordPress plugin changelog for a fixed version and whether registration or profile fields need authentication to trigger the stored payload.","how_to_check":"- Check the installed Pie Register version in the WordPress admin plugins list or in the plugin's main file header.\n- Compare the installed version against `3.8.4.15`; the sources say versions through that number are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Pie Register WordPress plugin at version 3.8.4.15 or earlier are in scope, per the NVD description. The sources do not say which configurations or user roles make the stored payload reachable, so treat any site with the plugin as potentially exposed until the vendor's status is confirmed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4221,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the WordPress plugin changelog for a fixed version and whether registration or profile fields need authentication to trigger the stored payload.","search":"'-119488':12A,15A '-2026':11A,14A '3.8.4.15':9A,50B,101C 'affect':68B,95C 'allow':91C 'attack':52B 'browser':61B 'code':56B 'cross':42B,79C 'cross-sit':41B,78C 'cve':10A,13A 'flaw':45B 'generat':77C 'improp':70C 'input':73C 'issu':94C 'n/a':99C 'neutral':71C 'packag':19B 'page':69B,76C 'pie':1A,17A,21B,28B,86C,89C,96C 'pie-regist':20B,88C 'pie-register':16A 'plugin':4A,34B 'rajani':37B,85C 'regist':2A,22B,29B,87C,90C,97C 'register':18A 'registr':33B 'run':58B 'save':54B 'script':44B,55B,81C 'shamim':36B,84C 'site':43B,80C 'store':5A,24B,40B,92C 'stored-xss':23B 'user':32B,64B 'version':8A,47B 'view':66B 'vulner':82C 'web':75C 'wordpress':3A,26B,31B 'xss':6A,25B,27B 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Pie Register plugin at version 3.8.4.15 or earlier. The NVD record gives a CVSS vector with no privileges required and user interaction needed, but no source read says which field stores the payload. Sites without the plugin, or already on 3.8.4.16 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pieregister"],"ptokens":["pie","register"],"labels":["high","package","pieregister","storedxss","wordpress","xss"],"campaign_type":null,"search_a":"'-119488':12A,15A '-2026':11A,14A '3.8.4.15':9A 'cve':10A,13A 'pie':1A,17A 'pie-register':16A 'plugin':4A 'regist':2A 'register':18A 'store':5A 'version':8A 'wordpress':3A 'xss':6A","search_b":"'3.8.4.15':50B 'affect':68B 'attack':52B 'browser':61B 'code':56B 'cross':42B 'cross-sit':41B 'flaw':45B 'packag':19B 'page':69B 'pie':21B,28B 'pie-regist':20B 'plugin':34B 'rajani':37B 'regist':22B,29B 'registr':33B 'run':58B 'save':54B 'script':44B,55B 'shamim':36B 'site':43B 'store':24B,40B 'stored-xss':23B 'user':32B,64B 'version':47B 'view':66B 'wordpress':26B,31B 'xss':25B,27B","search_c":"'3.8.4.15':101C 'affect':95C 'allow':91C 'cross':79C 'cross-sit':78C 'generat':77C 'improp':70C 'input':73C 'issu':94C 'n/a':99C 'neutral':71C 'page':76C 'pie':86C,89C,96C 'pie-regist':88C 'rajani':85C 'regist':87C,90C,97C 'script':81C 'shamim':84C 'site':80C 'store':92C 'vulner':82C 'web':75C 'xss.this':93C","first_public_at":"2026-11-06T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119488","severity":null,"published_at":"2026-11-06T08:17:18+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119488:1877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119488","severity":null,"published_at":"2026-11-06T08:44:57+00:00","modified_at":"2026-11-06T08:44:57+00:00","first_seen_at":"2026-11-06T08:44:57+00:00","fetched_at":"2026-11-06T08:44:57+00:00","note":"NVD (Patchstack CNA) says stored XSS in Pie Register <= 3.8.4.15; CVSS vector AV:N/PR:N/UI:R. Fix 3.8.4.16 comes only from the HOL Guard page relaying Patchstack; no vendor changelog or Patchstack page read, so nothing marked verified. Exact injection point and auth requirement not stated in any source. Separate later CVE (WPSEC-2026-2545, avatar alt XSS, fixed in 3.8.4.17) is a different issue; 3.8.4.16 was released 2026-10-29 per WPSec.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-119488","http://hol.org/guard/security/cves/CVE-2026-119488-wordpress-pie-register-plugin-38415-cross-site"]}],"documents":[{"id":84937,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119488","title":"NVD CVE-2026-119488","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84938,"url":"http://hol.org/guard/security/cves/CVE-2026-119488-wordpress-pie-register-plugin-38415-cross-site","title":"HOL Guard: Pie Register <= 3.8.4.15 XSS (relays Patchstack, fix 3.8.4.16)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}