# Pie Register <= 3.8.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Display Name in Avatar Alt Attribute

- **ID:** WPSEC-2026-2545
- **Plugin:** Pie Register – User Registration, Profiles & Content Restriction (`pie-register`), https://wordpress.org/plugins/pie-register/
- **Affected versions:** all versions before 3.8.4.17
- **Fixed in:** 3.8.4.17 (Update to 3.8.4.17 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pie-register
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2545/

## Description

The Pie Register plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom avatar rendering (get_avatar filter) in all versions up to, and including, 3.8.4.16. This is due to insufficient output escaping: the alt text is put unescaped into a single-quoted alt attribute of the replacement img tag. Callers such as the core Avatar and comment avatar blocks build that alt text from the user's display name or comment author name, and WordPress does not strip single quotes from those names. This makes it possible for authenticated attackers, with subscriber-level access and above, who have a Pie Register profile picture to inject arbitrary web scripts that execute when a user views a front-end page that shows the attacker's avatar, such as a page where the attacker has commented.

## References

- https://wpsec.com/vuln/WPSEC-2026-2545/
- https://plugins.svn.wordpress.org/pie-register/tags/3.8.4.17/
- https://wordpress.org/plugins/pie-register/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2545/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.