Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T08:17:18.900Z",
  "pubdate": "2026-11-06T08:17:18.900Z",
  "executiveSummary": "The Pie Register plugin for WordPress is affected by an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS).\nThis vulnerability allows an authenticated attacker with sufficient privileges to inject malicious scripts into application inputs, which are then persisted in the database.\nWhen a victim, such as an administrator, views the affected page, the malicious script executes within their browser session.\nThe impact includes the potential for session hijacking, unauthorized actions performed on behalf of the victim, and the exfiltration of sensitive information.\nAffected versions range from n/a through 3.8.4.15.\nRisk is elevated due to the nature of Stored XSS, which ensures the payload executes automatically upon the target accessing the compromised page, requiring no further interaction from the user after the initial injection.",
  "technicalDetails": "The vulnerability originates from a failure to properly sanitize and validate user-supplied input before it is rendered in the administrative or public-facing dashboards of the Pie Register plugin.\nBecause the input is stored directly in the database without adequate neutralization, the application interprets injected HTML and JavaScript payloads as legitimate elements of the page structure during subsequent requests.\nThe attack flow begins with the adversary identifying an input vector—typically a profile field, registration form setting, or plugin configuration parameter—that does not implement strict input filtering or output encoding.\nThe attacker submits a malicious payload, such as <script>alert(document.cookie)</script>, into the vulnerable field. The application processes this request and commits the unencoded payload to the backend database.\nOnce stored, the malicious payload is served to any user who navigates to the affected administrative interface or front-end page where the data is displayed. The victim's web browser parses the payload as executable code rather than plain text, triggering the script in the context of the victim's authenticated session.\nThis execution allows the attacker to bypass the Same-Origin Policy (SOP), enabling the theft of sensitive session cookies, CSRF tokens, or personal identifiable information (PII).\nFurthermore, the attacker can leverage this access to perform unauthorized administrative actions, such as modifying plugin settings, creating new administrator accounts, or redirecting users to external malicious domains.\nGiven that Pie Register is designed to handle user registration and profile management, the vulnerability is particularly dangerous as it could be used to facilitate targeted phishing or drive-by download attacks against site administrators or high-privilege users.\nThe exploitation does not require advanced network-level access, but it does necessitate that the attacker has the ability to interact with the plugin's input fields, effectively requiring a level of authentication or a misconfigured registration workflow that permits arbitrary input submission."
}