WordPress plugin
Pie Register – User Registration, Profiles & Content Restriction security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical7
- High7
- Medium15
- Low0
All Pie Register – User Registration, Profiles & Content Restriction vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar ≤3.8.4.16Update to 3.8.4.17 | CVE-2026-119158 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.8.4.15Update to 3.8.4.16 | CVE-2026-119488 | |
| High8.8 | Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation ≤3.8.3.4Update to 3.8.3.5 | CVE-2024-6069 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤3.8.3.2Update to 3.8.3.3 | CVE-2024-27957 | |
| High8.1 | Authentication Bypass <3.7.1.6Update to 3.7.1.6 | CVE-2021-24647 | |
| Critical9.8 | Authentication Bypass ≤3.7.1.4Update to 3.7.1.5 | CVE-2025-34077 | |
| Critical9.8 | Unauthenticated SQL Injection <3.7.1.6Update to 3.7.1.6 | CVE-2021-24731 | |
| Critical9.8 | SQL Injection <3.1.2Update to 3.1.2 | CVE-2019-15659 | |
| High7.1 | Unauthenticated Cross-Site Scripting <3.0.18Update to 3.0.18 | — | |
| Critical9.8 | SQL Injection ≤3.0.9Update to 3.0.10 | CVE-2018-10969 | |
| Critical9.8 | SQL Injection 2.0.14 – 2.0.15Update to 2.0.16 | — | |
| Critical9.8 | 2.0.15 - Authentication Bypass 2.0.14 – 2.0.15Update to 2.0.16 | — | |
| High7.1 | Cross-Site Scripting <2.0.15Update to 2.0.15 | — | |
| High7.3 | Missing Authorization ≤2.0.13Update to 2.0.14 | CVE-2014-8802 |
- High7.2Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar
≤3.8.4.16Update to 3.8.4.17
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.4.15Update to 3.8.4.16
- High8.8Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
≤3.8.3.4Update to 3.8.3.5
- Critical9.8Unauthenticated Arbitrary File Upload
≤3.8.3.2Update to 3.8.3.3
- High8.1Authentication Bypass
<3.7.1.6Update to 3.7.1.6
- Critical9.8Authentication Bypass
≤3.7.1.4Update to 3.7.1.5
- Critical9.8Unauthenticated SQL Injection
<3.7.1.6Update to 3.7.1.6
- Critical9.8SQL Injection
<3.1.2Update to 3.1.2
- High7.1Unauthenticated Cross-Site Scripting
<3.0.18Update to 3.0.18
- Critical9.8SQL Injection
≤3.0.9Update to 3.0.10
- Critical9.8SQL Injection
2.0.14 – 2.0.15Update to 2.0.16
- Critical9.82.0.15 - Authentication Bypass
2.0.14 – 2.0.15Update to 2.0.16
- High7.1Cross-Site Scripting
<2.0.15Update to 2.0.15
- High7.3Missing Authorization
≤2.0.13Update to 2.0.14
Pie Register – User Registration, Profiles & Content Restriction: common questions
Does Pie Register – User Registration, Profiles & Content Restriction have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in Pie Register – User Registration, Profiles & Content Restriction: 7 critical, 7 high, 15 medium. None are known to affect version null.
How do I check which version of Pie Register – User Registration, Profiles & Content Restriction I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Pie Register – User Registration, Profiles & Content Restriction vulnerability?
CVE-2026-119158, published Nov 6, 2026: Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar. Severity: High (CVSS 7.2).
Is any Pie Register – User Registration, Profiles & Content Restriction vulnerability listed in CISA KEV?
No. None of the known Pie Register – User Registration, Profiles & Content Restriction vulnerabilities is currently listed in the CISA KEV catalog.