---
id: "CVE-2026-119488"
page: "https://infrastack.ai/live/CVE-2026-119488"
kind: "vulnerability"
aliases: ["CVE-2026-119488"]
title: "Pie Register WordPress plugin: stored XSS through version 3.8.4.15"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pie-register", "fixed": ["3.8.4.16"], "affected": "<= 3.8.4.15", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "pie-register", "stored-xss", "wordpress", "xss"]
not_affected_if: ["patched-3.8.4.16", "plugin-not-installed"]
published_at: "2026-11-06T08:17:18+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:44:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119488", "first_seen_at": "2026-11-06T08:40:33+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119488", "first_seen_at": "2026-11-06T08:44:57+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-119488", "http://hol.org/guard/security/cves/CVE-2026-119488-wordpress-pie-register-plugin-38415-cross-site"]}]
exploit_sources: []
---

# Pie Register WordPress plugin: stored XSS through version 3.8.4.15

Link for people: https://infrastack.ai/live/CVE-2026-119488 (this .md is for agents)

Pie Register, a WordPress user registration plugin by Shamim Rajani, has a stored cross-site scripting flaw in versions up to 3.8.4.15. An attacker can save script code that runs in the browser of other users who view the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:pie-register affected <= 3.8.4.15 fixed 3.8.4.16

## How to check

- In WordPress admin go to Plugins and read the Pie Register version, or read the Version header in wp-content/plugins/pie-register/pie-register.php.
- With WP-CLI: wp plugin get pie-register --field=version. Versions <= 3.8.4.15 are affected; update to 3.8.4.16 or later (3.8.4.17 is newer).

## Fix

Update Pie Register to 3.8.4.16 or later (reported via Patchstack relay, not confirmed on vendor changelog). 3.8.4.17 is current per WPSec and also fixes a separate avatar XSS, so move to the latest version.

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119488
- 2026-11-06T08:44:57+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-119488 — NVD (Patchstack CNA) says stored XSS in Pie Register <= 3.8.4.15; CVSS vector AV:N/PR:N/UI:R. Fix 3.8.4.16 comes only from the HOL Guard page relaying Patchstack; no vendor changelog or Patchstack page read, so nothing marked verified. Exact injection point and auth requirement not stated in any source. Separate later CVE (WPSEC-2026-2545, avatar alt XSS, fixed in 3.8.4.17) is a different issue; 3.8.4.16 was released 2026-10-29 per WPSec.

## Documents

- [advisory] NVD CVE-2026-119488 https://nvd.nist.gov/vuln/detail/CVE-2026-119488
- [mentions] HOL Guard: Pie Register <= 3.8.4.15 XSS (relays Patchstack, fix 3.8.4.16) http://hol.org/guard/security/cves/CVE-2026-119488-wordpress-pie-register-plugin-38415-cross-site

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_