sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total23
Critical6
High4
Medium11
Reset
Showing 1-20 of 23 records
Threat Entry Updated 2026-11-10

Pie Register - Security Vulnerability (CVE-2026-96961)

The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults (disabling registration security controls such as new-user email verification) and to destroy a Pie Register WordPress plugin through 3.8.4.15 data table.

PLUGIN Pie Register

CVE-2026-96961

MEDIUM CVSS 6.5 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

Pie Register - Security Vulnerability (CVE-2026-96963)

The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

PLUGIN Pie Register

CVE-2026-96963

LOW CVSS 2.7 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Pie Register - Security Vulnerability (CVE-2026-119158)

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is…

PLUGIN Pie Register

CVE-2026-119158

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

Pie Register - Security Vulnerability (CVE-2026-96962)

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.

PLUGIN Pie Register

CVE-2026-96962

LOW CVSS 3.7 2026-10-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-22

Pie Register - Security Vulnerability (CVE-2026-10530)

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.

PLUGIN Pie Register

CVE-2026-10530

MEDIUM CVSS 5.3 2026-06-22
Open Full Technical Breakdown
Threat Entry Updated 2026-07-24

Pie Register - Broken Access Control (CVE-2026-3571)

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registration form status.

PLUGIN Pie Register

CVE-2026-3571

MEDIUM CVSS 6.5 2026-04-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Remote Code Execution (CVE-2025-34077)

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.

PLUGIN Pie Register

CVE-2025-34077

CRITICAL CVSS 10.0 2025-07-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Information Disclosure (CVE-2024-13818)

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.

PLUGIN Pie Register

CVE-2024-13818

MEDIUM CVSS 5.3 2025-02-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Broken Access Control (CVE-2024-6069)

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server

PLUGIN Pie Register

CVE-2024-6069

HIGH CVSS 8.8 2024-07-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Authentication Bypass (CVE-2024-4544)

The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

PLUGIN Pie Register

CVE-2024-4544

CRITICAL CVSS 9.8 2024-05-24
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - SQL Injection (CVE-2021-24731)

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.

PLUGIN Pie Register

CVE-2021-24731

CRITICAL CVSS 9.8 2021-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Security Vulnerability (CVE-2021-24647)

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username

PLUGIN Pie Register

CVE-2021-24647

HIGH CVSS 8.1 2021-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Pie Register - Cross-Site Scripting (XSS) (CVE-2021-24239)

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.

PLUGIN Pie Register

CVE-2021-24239

MEDIUM CVSS 6.1 2021-04-22
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.