Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-96963

Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pie Register
CVE-2026-96961

Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction

The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register WordPress plugin through 3.8.4.15 data table.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pie Register
CVE-2026-119158

Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is emitted to unauthenticated visitors) to store the payload, then logs in as the newly created Subscriber to post a comment that triggers delivery to all page visitors.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Genetech Products Wordpress-extensions
Products
Pie Register Pie Register
CVE-2026-119488

WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Shamim Rajani Wordpress-extensions
Products
Pie Register Pie Register
CVE-2026-103345

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Shamim Rajani Wordpress-extensions
Products
Pie Register Pie Register
CVE-2026-96962

Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pie Register