Pie Register <= 3.8.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Display Name in Avatar Alt Attribute
- ID
- WPSEC-2026-2545
- Plugin
- Pie Register – User Registration, Profiles & Content Restriction (pie-register)
- Affected
- all versions before 3.8.4.17
- Remediation
- Update to 3.8.4.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Pie Register on WPSec AttackSurface
- Fix released
- Published
Description
The Pie Register plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom avatar rendering (get_avatar filter) in all versions up to, and including, 3.8.4.16. This is due to insufficient output escaping: the alt text is put unescaped into a single-quoted alt attribute of the replacement img tag. Callers such as the core Avatar and comment avatar blocks build that alt text from the user's display name or comment author name, and WordPress does not strip single quotes from those names. This makes it possible for authenticated attackers, with subscriber-level access and above, who have a Pie Register profile picture to inject arbitrary web scripts that execute when a user views a front-end page that shows the attacker's avatar, such as a page where the attacker has commented.
References
- https://wpsec.com/vuln/WPSEC-2026-2545/
- https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.17/
- https://wordpress.org/plugins/pie-register/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS