Description

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is emitted to unauthenticated visitors) to store the payload, then logs in as the newly created Subscriber to post a comment that triggers delivery to all page visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T04:17:13.190Z",
  "pubdate": "2026-11-07T04:17:13.190Z",
  "executiveSummary": "The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) via the 'first_name' parameter. This vulnerability affects all versions up to, and including, 3.8.4.16. The issue arises from a failure to adequately sanitize user-supplied input and perform context-aware output escaping within the plugin's registration logic.\nSuccessful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript into the WordPress environment. This payload is stored persistently and executes within the browser of any user who views the affected page, such as administrators or other site visitors. The risk is significant, as it can lead to unauthorized actions, session hijacking, or the distribution of malicious content. Exploitation is contingent upon public registration being enabled and the registration form including a Profile Picture field. An attacker can leverage the publicly accessible nonce to register a new Subscriber account, store the malicious payload within the profile metadata, and subsequently trigger the execution of the script, for example, by posting a comment or navigating to a rendered profile view.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of user-controllable data during the registration process. Specifically, the 'first_name' parameter, processed during account creation, is not subjected to robust sanitization or output encoding filters before being persisted to the database. Because the plugin does not enforce strict input validation or escape the stored data upon rendering, it inadvertently allows the injection of malicious markup, including <script> tags or event handler attributes.\nThe attack flow begins with an unauthenticated actor accessing the public registration form. The plugin provides a valid security nonce to unauthenticated visitors, facilitating form submission. The attacker crafts a registration request, embedding a JavaScript payload into the 'first_name' field. Upon form submission, this payload is stored as user metadata in the WordPress database.\nThe exploitation path requires the presence of a 'Profile Picture' field during registration. After the account is successfully created with the malicious payload, the attacker logs in as the newly provisioned Subscriber. The stored script is then executed when the payload is rendered in the browser. A common delivery vector involves the attacker posting a comment or interacting with site features that cause the system to render the compromised user profile information. When a victim, such as a site administrator or another user, views the page where the injected content is rendered, the attacker's script executes within the victim's session context.\nThis execution context allows the attacker to perform actions on behalf of the victim, such as modifying administrative settings, creating new administrative users, or exfiltrating sensitive session tokens and cookies. Because the script executes every time the injected page is accessed, the vulnerability constitutes a persistent, high-impact Stored XSS vector. The vulnerability is present across all versions up to and including 3.8.4.16, making it a critical concern for any WordPress installation with public registration enabled, as the combination of insufficient input hygiene and inadequate output escaping provides a reliable conduit for cross-site execution."
}