CVE-2026-119488
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WordPress Pie Register plugin in versions up to 3.8.4.15 contains an improper neutralization of input during web page generation (cross-site scripting) vulnerability, enabling stored XSS.
Risk Assessment
An attacker can store a malicious script that executes in other users' browsers, enabling session theft or actions on their behalf. This may lead to administrator account takeover.
Recommendation
Update the Pie Register plugin to a version later than 3.8.4.15. Additionally, enforce input filtering and encoding and consider deploying a WAF.
Other vulnerabilities in Pie Register
See all- CVE-2026-103345Medium
Pie Register plugin has a sensitive information insertion vulnerability, allowing retrieval of embedded sensitive data. Affects versions up to 3.8.4.13.
- CVE-2026-3571Medium
The Pie Register plugin for WordPress has a missing capability check in the pie_main() function, allowing unauthenticated attackers to change registration form status. Affects versions up to and including 3.8.4.8.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS