CVE-2026-119158 Details

A stored cross-site scripting vulnerability has been identified in the Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress, affecting all versions through 3.8.4.16. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute when users access the compromised page. Exploitation is possible when public registration is enabled and the registration form includes a Profile Picture field. In this scenario, an attacker can register through the public form, embedding a script in the 'first_name' parameter. After logging in as a Subscriber, the attacker can post a comment that delivers the injected script to all page visitors.

Users are advised to update the Pie Register – User Registration, Profiles & Content Restriction plugin to version 3.8.4.17 or a newer patched version.